---
title: "Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion"
description: Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service (RaaS) operation that first appeared in 2022.
canonical_url: https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/
locale: en
last_updated: 2026-10-29
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

28 October 2026

# Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion

Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service (RaaS) operation that first appeared in 2022.

Authors: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/), [Darrel Virtusio](https://www.acronis.com/en/tru/authors/virtusio-darrel/), [Eliad Kimhy](https://www.acronis.com/en/tru/authors/kimhy-eliad/)**

## Summary

*   Qilin is a Russian-speaking ransomware-as-a-dervice (RaaS) operation that has been active since 2022 and became one of the most active ransomware groups by reported victim count in 2025.
*   The group targets organizations across multiple sectors and regions, including health care. Affiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools.
*   Qilin uses a flexible ransomware platform that allows affiliates to tailor attacks to the victim environment, including the encryption of local files, network shares and virtual machine infrastructure.
*   Qilin has been linked to other threat groups, including Moonstone Sleet and Scattered Spider. Some Qilin operators have also created separate RaaS operations, including The Gentlemen and Securotrop.
*   Securotrop remains part of the Qilin affiliate network while operating a separate data leak site. This arrangement gives Securotrop an independent channel for publishing stolen victim data while maintaining its relationship with the wider Qilin operation.

## Introduction

Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service (RaaS) operation that first appeared in 2022. After relatively limited activity during its first years, Qilin expanded rapidly: It recorded 179 publicly reported attacks in 2024 and more than 1,000 claimed victims in 2025, making it the most active ransomware operation by victim count during that year. In 2026, it had already claimed more than 900 victims and remained one of world’s most active ransomware groups.

## Background and history

One of the most notable operations attributed to Qilin occurred in 2024, when the group attacked Synnovis, a U.K.-based provider of diagnostic and pathology services for healthcare organizations. The attack disrupted medical services across several London hospitals and affected thousands of medical procedures. The incident exposed data on approximately 900,000 individuals and caused an estimated $44 million in financial impact, while Qilin demanded a $50 million ransom.

Following a significant increase in activity during 2025, Qilin experienced an internal dispute in August of the same year involving an affiliate operating under the alias “hastalamuerte.” The affiliate accused Qilin’s operators of conducting an “exit scam,” claiming that, during a ransom negotiation, the core group caused the relevant chat history to “mysteriously disappear” from the encrypted Tox messaging platform and withheld approximately $48,000 of the affiliate’s share.

The incident was accompanied by the disclosure of Qilin’s internal affiliate infrastructure, including credentials, screenshots of the affiliate panel, internal chats, integrated attack infrastructure and a presence in DeepSeek AI chatbots.

In 2026, Qilin continued to operate as a ransomware-as-a-service (RaaS) operation. Its affiliate model offers participants up to 85% of ransom payments, and this high revenue share helps the group recruit and retain affiliates. The model has supported Qilin’s continued activity across multiple sectors and regions.

## Victimology

Qilin appears to exclude organizations in Commonwealth of Independent States (CIS) countries and primarily targets organizations in the United States, Canada, Europe and other regions. Health care is a notable target sector, accounting for approximately 13.3% of identified victims. Although some ransomware operators avoid critical infrastructure and essential services to limit law-enforcement attention, Qilin’s activity shows that health care organizations remain at significant risk.

![Image 1: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/ac036169a63ae0e4affd68150c16a665.png)

## Campaign overview

Qilin operates as a ransomware-as-a-service (RaaS) operation, meaning that individual affiliates can use different methods to gain access to victims. Common approaches include targeted phishing, compromised VPN and RDP credentials, exploitation of vulnerable internet-facing applications and abuse of remote-management tools.

Once inside the network, attackers typically use legitimate administrative tools to move laterally, obtain higher privileges, disable security and recovery mechanisms, and steal sensitive data before deploying the ransomware across as many systems as possible. Qilin commonly follows a double-extortion model, combining large-scale encryption with threats to publish stolen information if the ransom is not paid.

Qilin has also been linked to several threat groups, including Moonstone Sleet and has an alleged partnership with Scattered Spider. Some Qilin operators have also established separate RaaS groups, including The Gentlemen and Securotrop. The Gentlemen became a competitor to Qilin, while Securotrop continues to operate within the Qilin affiliate network but maintains a separate data leak site.

## Technical analysis

The Windows sample is a 4.69 MB PE32 executable — large for ransomware — with no resources and 6,598 identified functions. Although the PE detector could not identify the programming language, the code contains numerous references to Rust source files. Because Rust executables commonly include all linked packages, this implementation likely accounts for the sample’s relatively large size and high function count.

![Image 2: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/ebe40f5a2d8e59dd6b4d1044f693d1eb.png)

### Command line arguments

Qilin supports a set of command-line arguments that control its execution, encryption scope, system preparation and post-encryption behavior. During initialization, the ransomware parses these arguments and stores their corresponding values in internal configuration variables. These variables are subsequently used to determine which functionality to enable or disable during execution. The following table also includes internal values that represent the default parameters used when no command-line arguments are provided.

**Argument**

**Description**

**Internal parameter**

-password

Provide a unique sample password required for execution.

no-escalate

Disable privilege escalation.

enable_sandbox_detection: true

impersonate

Enable/use token or user impersonation.

impersonate_account: ""

safe

Forces the sample to boot the system in safe mode.

run_in_safe_mode: false

no-priority

Do not modify the IO priority.

no_priority: false

no-admin

Do not require/run with administrator privileges.

should_be_admin: true

no-local

Disable processing of local resources / files.

encrypt_local_computer: true

no-mounted

Exclude mounted drives / volumes from processing.

encrypt_mounted_shares: true

no-domain

Disable domain-related operations.

encrypt_domain_area: true

no-network

Disable network resource processing.

encrypt_network_area: true

no-ef

Disables the extension filter, preventing Qilin from applying extension-based filtering when selecting files for encryption.

enable_extension_filter: true

no-ff

Disables file filter, preventing Qilin from applying its file-based exclusion or selection criteria.

enable_file_filter: true

no-df

Disables the directory filter, preventing Qilin from applying directory-based exclusion or selection criteria.

enable_dir_filter: true

no-autostart

Disable automatic-start/persistence behavior.

enable_autostart: true

no-proc

Disable process termination.

enable_process_killer: true

no-services

Disable service termination.

enable_service_killer: true

no-vm

Disable VM-related termination/handling.

enable_vm_killer: true

kill-cluster

Enable cluster-related behavior.

enable_cluster_killer: false

no-extension

Do not append an extension to encrypted files.

with_extension: true

no-wallpaper

Do not change the desktop wallpaper after encryption.

no_wallpaper: false

no-note

Do not create / drop the ransom note.

is_note: true

no-delete

Disable deletion operations.

no-destruct

Disable destructive operations.

is_destruct: true

no-zero

Disable zeroing / wiping behavior.

is_zeroing: true

print-image

Print/display an image, potentially as part of a post-encryption notification.

“print_image: false

print-delay

Delay associated with print-image or image printing.

print_delay: 0

forced

Force execution despite some normal checks / conditions.

force: false

debug

Enable debugging behavior.

debug: false

no-logs

Disable logging.

no_logs: true

fspread

Enable spreading / propagation behavior.

is_spreading: false

spread-vcenter

Spread through the VMware vCenter infrastructure.

is_spreading_vcenter: false

dry-run

Perform a test / dry-run without carrying out the full operation.

is_dry_run: false

logs

Enable logs collection to a ZIP archive.

collect_logs: false

The _**‘-password’**_ argument is mandatory for execution. The supplied password is passed to a SHA-256 hashing function, and the resulting hash is compared against the hardcoded value:

_6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2_

If the calculated hash does not match the expected value, or if the **-password** argument is not provided, Qilin terminates its execution.

### Configuration

The sample stores its configuration in JSON format, beginning with an RSA public key.

![Image 3: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/c4446e3789f3c317dd6c716ef0c5e464.png)

_**directory\_black\_list**_ contains directory names that are excluded from the encryption process. The list includes Windows system directories and other locations whose encryption could impair system functionality, as well as directories associated with commonly used browsers. Excluding browser-related directories may help preserve the victim's ability to access the system and communicate with the attackers to negotiate or pay the ransom.

_"windows", "system volume information", "intel", "admin$", "ipc$", "sysvol", "netlogon", "$windows.~ws", "application data", "mozilla", "program files (x86)", "program files", "$windows.~bt", "msocache", "tor browser", "programdata", "boot", "config.msi", "google", "perflogs", "appdata", "windows.old", "appdata", "..", ".", "boot", "windows", "windows.old", "$recycle.bin", "admin$"_

**file_black_list** contains file names that are excluded from encryption. Most entries correspond to Windows system and configuration files that may be located outside the directories excluded by **directory_black_list**. This provides an additional layer of protection against encrypting critical system files regardless of their location.

_"desktop.ini", "autorun.ini", "ntldr", "bootsect.bak", "thumbs.db", "boot.ini", "ntuser.dat", "iconcache.db", "bootfont.bin", "ntuser.ini", "ntuser.dat.log", "autorun.inf", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "#recycle", "autorun.inf", "boot.ini", "bootfont.bin", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "desktop.ini", "iconcache.db", "ntldr", "ntuser.dat", "ntuser.dat.log", "ntuser.ini", "thumbs.db", "#recycle", "bootsect.bak"_

_**file\_pattern\_black\_list**_ contains file extensions and patterns that are excluded from encryption. These include executable files, scripts, drivers, Windows system components, configuration files, and other file types that may be required for system operation. The list also contains _**3Tqc380bbh**_, which corresponds to the configured _**company\_id**_ and represents the ransomware's encrypted-file extension.

_"themepack", "nls", "diapkg", "msi", "lnk", "exe", "scr", "bat", "drv", "rtp", "msp", "prf", "msc", "ico", "key", "ocx", "diagcab", "diagcfg", "pdb", "wpx", "hlp", "icns", "rom", "dll", "msstyles", "mod", "ps1", "ics", "hta", "bin", "cmd", "ani", "386", "lock", "cur", "idx", "sys", "com", "deskthemepack", "shs", "theme", "mpa", "nomedia", "spl", "cpl", "adv", "icl", "msu", "3Tqc380bbh"_

**process_black_list** contains process names that are excluded from the ransomware's process-handling logic. The entries include processes associated with virtualization platforms, databases, business applications, backup software, security products and remote-access software. The presence of these entries indicates that the ransomware applies specific handling rules to selected processes rather than treating all running processes uniformly.

_"vmms", "vmwp", "vmcompute", "agntsvc", "dbeng50", "dbsnmp", "encsvc", "excel", "firefox", "infopath", "isqlplussvc", "sql", "msaccess", "mspub", "mydesktopqos", "mydesktopservice", "notepad", "ocautoupds", "ocomm", "ocssd", "onenote", "oracle", "outlook", "powerpnt", "sqbcoreservice", "steam", "synctime", "tbirdconfig", "thebat", "thunderbird", "visio", "winword", "wordpad", "xfssvcon", "bedbh", "vxmon", "benetns", "bengien", "pvlsvr", "beserver", "raw\_agent\_svc", "vsnapvss", "cagservice", "qbidpservice", "qbdbmgrn", "qbcfmonitorservice", "sap", "teamviewer\_service", "teamviewer", "tv\_w32", "tv\_x64", "cvmountd", "cvd", "cvfwd", "cvods", "saphostexec", "saposcol", "sapstartsrv", "avagent", "avscc", "dellsystemdetect", "enterpriseclient", "veeamnfssvc", "veeamtransportsvc", "veeamdeploymentservice", "mvdesktopservice"_

_**win\_services\_black\_list**_ contains Windows service names that are excluded from the ransomware's service-handling logic. The list includes services associated with virtualization, backup and recovery software, databases, Microsoft Exchange, security software, SAP, Acronis and Veeam. Several entries use wildcard or regular-expression-like patterns, such as _**"(.*?)sql(.*?)"**_, allowing the ransomware to match multiple SQL-related services.

_"vmms", "mepocs", "memtas", "veeam", "backup", "vss", "sql", "msexchange", "sophos", "msexchange", "msexchange\$", "wsbexchange", "pdvfsservice", "backupexecvssprovider", "backupexecagentaccelerator", "backupexecagentbrowser", "backupexecdrivecimediaservice", "backupexecjobengine", "backupexecmanagementservice", "backupexecservice", "gxblr", "gxvss", "gxclmgrs", "gxcvd", "gxcimgr", "gxmmm", "gxvsshwprov", "gxfwd", "sapservice", "sap", "sap\$", "sapd\$", "saphostcontrol", "saphostexec", "qbcfmonitorservice", "qbdbmgrn", "qbidpservice", "acronisagent", "veeamnfssvc", "veeamdeploymentservice", "veeamtransportsvc", "mvarmor", "mvarmor64", "vsnapvss", "acrsch2svc", "(.?)sql(.?)"_

Other configuration parameters contain a campaign / build identifier, execution parameters and an account entry recovered from memory. The _**company\_id**_ value, _**3Tqc380bbh**_, is also present in the file-pattern blacklist and corresponds to the ransomware's file extension. The account value has been redacted in this report.

_"company\_id": "3Tqc380bbh"  
 "n": 0  
 "p": 1  
 "fast": 0  
 "skip": 0  
 "step": 0  
 "accounts": ["<redacted>@mills.local:<redacted>"]_

It also contains ransom note text at the end of the configuration.

### Mutex

Qilin creates a mutex to ensure that only one instance of the ransomware runs at a time. Hardcoded mutex value matches password hash that used earlier to validate the supplied **password** argument:

_6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2_

### Process token manipulations

First, it opens the current process token using _**GetTokenInformation**_ with the _**TokenElevationType**_ parameter (0x14) to determine whether the binary is running with elevated administrative rights. If high-privilege execution is confirmed, execution proceeds normally. If running unprivileged, the malware checks for the **--no-elevation** switch. When present, it bypasses operations requiring administrative rights and continues execution. Otherwise, the payload has a console output string that will ask to execute the payload under the administrator account.

![Image 4: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/2a3d6529a59821f93a6f501645e7d048.png)

When executed with administrator privileges, the sample also adjusts its own token by enabling several privileges:

**Privilege**

**Description**

SeDebugPrivilege

Allows a process to debug or access processes it would otherwise lack sufficient permissions to access. This can include opening processes owned by other users and obtaining or manipulating their process tokens.

SeImpersonatePrivilege

Allows a process to impersonate another user's security context after obtaining an appropriate impersonation token.

SeIncreaseBasePriorityPrivilege

Allows a process to increase the base priority of another process or modify its own scheduling priority beyond normal restrictions.

The sample also includes token impersonating logic that can be triggered with the ‘-impersonate’ argument. It obtains a process access token using _**OpenProcessToken**_ and subsequently duplicates tokens using _**DuplicateTokenEx**_. The first duplication requests a primary token (TokenType = 1), while the second requests an impersonation token (TokenType = 2). Both calls request _**MAXIMUM\_ALLOWED**_ (0x02000000) access and use the SecurityImpersonation level (2). The resulting impersonation token is assigned to the current thread via _**SetThreadToken**_, causing subsequent operations to execute under the duplicated token’s security context.

![Image 5: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/2615b232d65fdf70219722b71e3918ec.png)

### Virtualization software

The sample checks whether the current system is a virtual machine by executing the _**cpuid**_ instruction and inspecting bit 31, the Hypervisor Present value. A value of 1 indicates that the system is virtual.

![Image 6: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/e363825485dd65a1d25a1cdc44eea915.png)

This logic may serve to both detect sandboxes and identify virtual machines that are valid encryption targets for or must be terminated to access their files. The sample contains a string of virtualization platform names to identify the environment:

_Microsoft HvHyper-VVMwareVMwareVMwareVBoxVBoxVBoxVirtualBoxKVMKVM_

An additional VM check is performed by reading registry keys that are usually present on Hyper-V or Azure virtual machines.

_SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters_

If configured to target virtual machines, the sample executes a saved PowerShell script.

![Image 7: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/5d9edb735c073e2c15333c72df03ecad.png)

This script is extensive and performs the following functions:

*   Install .NET Framework if not present
*   Install the NuGet provider if not present
*   Change PowerCLI configuration
*   Disable cluster services
*   Obtain a list of ESXi hosts
*   Change ESXi password
*   Enable ESXi SSH
*   Change ESXi hosts' configurations
*   Upload and execute payloads on ESXi hosts to encrypt them

### Services and processes

To handle process and service termination, the binary spawns an independent execution thread. It enumerates running processes by invoking _**CreateToolhelp32Snapshot**_ and iteratively checks image names against the embedded _**process\_black\_list**_ to prevent stopping excluded binaries. Similarly, active services are validated against _**win\_services\_black\_list**_ before receiving the _**SERVICE\_CONTROL\_STOP**_ signal via ControlService.

![Image 8: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/1fb02928b8b4fe90dfa7cca7cf4e8be3.png)

### Final preparations

Sample calls the _**cpuid**_ instruction again, this time checking the 25-bit value against _2000000h,_ which corresponds to the AES instruction-set extension. If this bit is set, the processor supports _**AES-NI**_ instructions, allowing the malware to determine whether hardware-accelerated AES operations are available. If they are supported, it will use AES in CTR mode as the symmetric cipher; otherwise, it will use ChaCha20.

![Image 9: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/b58746eca5889d82df65677bffd9dfd1.png)

It also sets an error mode to value 1, which is _**SEM\_FAILCRITICALERRORS,**_ and forces the system not to display the critical-error-handler message box.

![Image 10: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/98373f322e529c4b731fa86e691442ec.png)

To provide auto-start, it sets a new registry key to the next path:

_HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run_

The key name is different each time and has the next pattern: _***[6 random letters]**_

The value of this key will be the path of the payload, including all arguments used to execute it.

The sample modifies Windows symbolic-link evaluation settings using _**fsutil**_, enabling both _**Remote-to-Local (R2L)**_ and _**Remote-to-Remote (R2R)**_ symbolic-link resolution. This allows symbolic links encountered on remote resources to be resolved to local or other remote targets, potentially facilitating traversal of linked resources during the ransomware's file-processing operations.

_/C fsutil behavior set SymlinkEvaluation R2R:1_

_/C fsutil behavior set SymlinkEvaluation R2L:1_

Next, it modifies the _**EnableLinkedConnections**_ policy to facilitate access to mapped network drives across elevated and non-elevated logon sessions, potentially allowing network resources available to the user to remain accessible during elevated execution:

_SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections_

The sample executes _**net use**_ to enumerate existing network connections and mapped network drives, allowing available remote resources to be identified before encryption.

Before encryption, Qilin deletes all available Volume Shadow Copies using _**vssadmin.exe delete shadows /all /quiet**_, preventing recovery of files through Volume Shadow Copy-based restoration mechanisms.

Additionally, it executes _**Wow64DisableWow64FsRedirection,**_ which disables file system redirection for the calling thread. After encryption is complete, it will revert this using _**Wow64RevertWow64FsRedirection**_.

### Encryption

Before starting to look for files, Qilin obtains detailed information about storage devices using next functions:

_SetupDiEnumDeviceInfo_

_SetupDiEnumDeviceInterfaces_

_SetupDiGetClassDevsW_

_SetupDiGetDeviceInstanceIdW_

_SetupDiGetDeviceInterfaceDetailW_

_GetLogicalDrives_

_GetDriveTypeW_

_WNetOpenEnumW_

Following drive enumeration, the binary initiates a recursive directory traversal across the discovered volumes using a dedicated worker thread that calls _**FindFirstFileW**_ and _**FindNextFileW**_. The routine strictly enforces exclusions for paths, filenames and extensions, matching them against embedded blacklists. The thread pool size allocated for encryption operations is dynamically determined by retrieving the _**dwNumberOfProcessors**_ property via _**GetSystemInfo**_.

As noted earlier, when hardware acceleration is available, the payload leverages _**AES-CTR**_ for file encryption using dedicated x86/x64 instructions, including _**aeskeygenassist**_, _**aesimc**_, and _**aesenc**_.

![Image 11: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/dcf96f569ad8889dd743abc9ec794933.png)

When hardware-accelerated instructions are unavailable, the payload falls back to _**ChaCha20**_ for file encryption. The binary incorporates an SSE-optimized implementation of the core _**ChaCha20**_ block routine, executing a 10-cycle loop in which each pass performs a full double-round, combining standard column and diagonal transformations.

![Image 12: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/4289dc47e0c772414682bdcdc8abdf46.png)

For each file, Qilin generates a 32-byte key using _**BCryptGenRandom**_ function. After encrypting the file content with that key, the ransomware encrypts the key with _**RSA-4096**_ using a hardcoded public key. It then appends the encrypted key to the encrypted file data right after a special delimiter.

![Image 13: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/3f16cc11cbdb1051b44167a2a8f2f295.png)

Qilin appends.3Tqc380bbh extension to each encrypted file’s original name. This extension may differ between victims.

### Ransom note

Qilin drops a ransom note file named _***README-RECOVER-[company-id].txt**_ in each encrypted folder on the system. The note describes the encryption, threatens to publish the stolen data if the victim does not cooperate, and warns against modifying encrypted files or using third-party recovery tools. It also claims that police or authorities cannot help obtain the encryption key. Besides blog and leak site links, it also contains a link to the threat actor's chat page with login and password credentials.

![Image 14: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/6f828b660ea463b60013ec9d73267085.png)

### Logs

Qilin logs each execution step and outputs the entries to the console. Each entry includes the current time, elapsed time since execution began, log level and associated message.

![Image 15: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/919c56bb589271f7a2128124ec2441ee.png)

After encryption starts, the process stops logging to the console and switches to file logging. It creates a folder _**‘%AppData%\Local\Temp\QLOG’**_ and starts writing _**.txt**_ files for each thread it runs. Those logs contain the full execution process, including the same data as the console log, as well as preparations, the file search routine and encryption.

![Image 16: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/4a73fc1e5fff291373cae5a23c9c4c45.png)

After encryption completes, Qilin collects the log files in the _**QLOGS.zip**_ archive, which the attacker can then exfiltrate.

### Blog site

Qilin’s blog lists information about victims, including selected stolen files presented as evidence and each case’s publication status. The status is shown as either “Published” or as a countdown indicating how long the victim has to pay the ransom before the data is released. Although Qilin has operated since 2022, the earliest entry on the blog is dated March 21, 2025. The site also displays a QR code and a link to WikiLeakV2.

![Image 17: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/d3974672f404997f83932027efc3077c.png)

**WikiLeaksV2** is a clearnet leak site associated with the Qilin ransomware operation. While it does not belong to the Qilin actors, the site is used to publish and distribute data stolen from organizations compromised by Qilin and its affiliates as part of the group's double-extortion strategy. The platform, therefore, serves as an additional publicly accessible channel for exposing stolen victim data and increasing pressure on organizations to pay the demanded ransom.

![Image 18: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/d3310d97261dce6719113013102003d6.png)

## Conclusion and impact

Qilin remains one of the most active ransomware operators in the world. Its extensive configuration options allow affiliates to tailor the ransomware to their specific operational requirements. The malware can encrypt files locally, on network shares, within virtual machines and across domain environments. It also incorporates self-propagation capabilities that can enable rapid deployment across an entire network, including virtualization infrastructure.

Qilin dynamically selects encryption methods based on the compromised system's capabilities, enabling it to encrypt as efficiently as possible. Unlike many other ransomware groups, Qilin does not rely exclusively on its own data-leak infrastructure. Instead, it uses the WikiLeaksV2 site to publish stolen data when victims refuse to pay the ransom. The group also actively targets the healthcare sector, further increasing the potential impact of its operations and making Qilin a significant ransomware threat in 2026.

## Detection guidance and mitigation recommendations

*   Deploy and maintain an EDR or other endpoint security solution capable of detecting ransomware activity, including mass file encryption, suspicious process and service termination, security-tool tampering, credential theft and unauthorized driver loading.
*   Secure VPN, RDP and other remote-access services with strong authentication, preferably phishing-resistant MFA. Restrict remote access to trusted networks or devices where possible, disable unnecessary remote-access services and monitor for unusual login activity.
*   Keep operating systems, applications, network devices, security products and third-party software up to date. Apply security patches promptly, particularly for vulnerabilities in internet-facing applications that could allow attackers to gain initial access or escalate privileges.
*   Monitor and restrict the use of PowerShell, remote administration tools and other utilities commonly abused by ransomware operators. Alert on unusual administrative activity, especially when these tools are used to disable security controls, modify system settings or execute commands across multiple hosts.
*   Maintain regular, tested backups using access controls that prevent compromised systems from modifying or deleting backup copies. Where possible, keep critical backups isolated from the production environment and monitor for attempts to access or delete backup data.

## Detection by Acronis

Acronis EDR / XDR detects and blocks this threat:

![Image 19: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/e650e96e96e65718ea33adfe9e95846c.png)

![Image 20: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion](https://staticfiles.acronis.com/images/content/0fc326f3bb52e7d996c628f82c316837.png)

## Indicators of Compromise (IOCs)

### Windows (Qilin)

24a24c5fe9a5dc242b2908d020f890ed5b3afe8146fade4e3ab8a07d19007b6d

011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756

516927b55038c1702bc8a6a0262a39d5fe45f4b07527fdc42415533a9665264a

43672ef1384888922c13838f695da58f8cb9b8ad47ce896b3b7151e7edd18afb

bd1cf7823cabbac2ea7b45f2d7c9dfcd6b9a24714b6d40377bdef82b9c88021b

4f8efbfe1f94dc7c6d5547c836e56ed56b1b3c33d324bd8619b8108c572b5ca6

e81e9a3a8baca74a5c73bb5d0904cd7ac145e330c4d4993bfd671f3396402416

### Windows (Securotrop)

e76fb9cf2da75e963e4d00b48500f59fa6a0e7d21915b8c54ca3d83c52b9d43b

62fd30a7841f36b389af9cf4b3230c666bf620d9f57eb3bf73a06fe86d0917ff

61820172ff5440c9e4f48695cc3551638306d06214cf72df41740dd08d734104

54f36b39e5bcee15acc530d70c173f26a1e1d7a62e866181d8a68309b4660928

### Network indicators

hxxp[://]kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion

hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion

hxxps[://]wikileaks2[.]site/

meuu4pqh6g4aqjk5i6ama4dt5z365qgilwfn53iqcyrdbzkd3d4secyd[.]onion

Related articles

[Configured to protect: How to properly use security policies](https://www.acronis.com/en/tru/posts/configured-to-protect-how-to-properly-use-security-policies/)  
[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)