Acronis research reveals how Qilin ransomware targets virtual infrastructure

Qilin ransomware is putting virtualized infrastructure and sensitive data at risk as its affiliate network expands. A new analysis from the Acronis Threat Research Unit (TRU), published October 28, 2026, examines how the operation combines adaptable ransomware, attacks on VMware ESXi environments and double extortion to pressure organizations.

Also known as Agenda, Qilin emerged in 2022. According to TRU, the group claimed more than 1,000 victims in 2025 and more than 900 in 2026 at the time of the research. These are claimed victim counts, not independently confirmed compromises, but they illustrate the scale of the operation’s public activity.

Qilin operates as ransomware-as-a-service, recruiting affiliates who carry out intrusions using its tools and infrastructure. TRU reports that participants can receive up to 85% of ransom payments. This model helps explain how a single ransomware brand can appear across different sectors and regions while using varied initial-access methods.

Affiliates commonly exploit vulnerable internet-facing applications, compromised VPN or Remote Desktop Protocol credentials, phishing and remote-management tools. After gaining access, they may move through a network, elevate privileges, interfere with security and recovery controls and steal information before encrypting systems.

The group’s relationships are also changing. TRU identifies links to other threat groups and describes Securotrop as operating within the Qilin affiliate network while maintaining a separate data leak site. That arrangement illustrates how ransomware operations can extend their reach through interconnected groups and publishing channels.

A central finding of the research is Qilin’s ability to target more than individual Windows files. The analyzed ransomware can reach network shares, domain environments and virtual machines. Its configuration options let affiliates adjust the scope of an attack to the systems they encounter.

TRU found virtualization-specific functionality that can identify ESXi hosts and modify their configurations before ransomware deployment. For organizations that depend on virtual machines to run essential applications, disruption at the host level can affect multiple workloads rather than one endpoint.

The Windows sample also contains mechanisms to interfere with recovery, including the deletion of Volume Shadow Copies. Its encryption routine selects AES when supported by the processor and otherwise uses ChaCha20. These details matter because they show an operation designed to work across different environments while limiting straightforward recovery options.

Encryption is only part of Qilin’s strategy. Affiliates also steal data and threaten to publish it if victims do not pay. TRU describes a leak site that displays victim entries and publication countdowns, creating another source of pressure during negotiations.

The health care sector is especially relevant. TRU reports that health care accounted for approximately 13.3% of identified victims. The research also recounts the 2024 attack on Synnovis, a U.K. diagnostic services provider, which disrupted medical services in London. The incident demonstrates how ransomware can affect operations that extend well beyond the compromised IT environment.

Qilin’s use of additional leak-publication channels means defenders must prepare for both service disruption and exposure of sensitive information. Restoring encrypted systems does not undo data theft.

The findings reinforce several practical defenses. Organizations and managed service providers should secure remote access with strong authentication, patch internet-facing systems promptly and monitor unusual administrative activity. Detection should cover suspicious encryption, attempts to stop security services and changes affecting virtual infrastructure.

Recovery planning deserves equal attention. Maintain isolated or otherwise protected backup copies, test restoration procedures and restrict the ability of compromised accounts to alter backups. Security teams should also review access to virtualization management interfaces and investigate unexpected changes to ESXi hosts.

Read the full Acronis TRU investigation for the technical analysis, detection guidance and indicators of compromise behind these findings.