Summary
- Qilin is a Russian-speaking ransomware-as-a-dervice (RaaS) operation that has been active since 2022 and became one of the most active ransomware groups by reported victim count in 2025.
- The group targets organizations across multiple sectors and regions, including health care. Affiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools.
- Qilin uses a flexible ransomware platform that allows affiliates to tailor attacks to the victim environment, including the encryption of local files, network shares and virtual machine infrastructure.
- Qilin has been linked to other threat groups, including Moonstone Sleet and Scattered Spider. Some Qilin operators have also created separate RaaS operations, including The Gentlemen and Securotrop.
- Securotrop remains part of the Qilin affiliate network while operating a separate data leak site. This arrangement gives Securotrop an independent channel for publishing stolen victim data while maintaining its relationship with the wider Qilin operation.
Introduction
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service (RaaS) operation that first appeared in 2022. After relatively limited activity during its first years, Qilin expanded rapidly: It recorded 179 publicly reported attacks in 2024 and more than 1,000 claimed victims in 2025, making it the most active ransomware operation by victim count during that year. In 2026, it had already claimed more than 900 victims and remained one of world’s most active ransomware groups.
Background and history
One of the most notable operations attributed to Qilin occurred in 2024, when the group attacked Synnovis, a U.K.-based provider of diagnostic and pathology services for healthcare organizations. The attack disrupted medical services across several London hospitals and affected thousands of medical procedures. The incident exposed data on approximately 900,000 individuals and caused an estimated $44 million in financial impact, while Qilin demanded a $50 million ransom.
Following a significant increase in activity during 2025, Qilin experienced an internal dispute in August of the same year involving an affiliate operating under the alias “hastalamuerte.” The affiliate accused Qilin’s operators of conducting an “exit scam,” claiming that, during a ransom negotiation, the core group caused the relevant chat history to “mysteriously disappear” from the encrypted Tox messaging platform and withheld approximately $48,000 of the affiliate’s share.
The incident was accompanied by the disclosure of Qilin’s internal affiliate infrastructure, including credentials, screenshots of the affiliate panel, internal chats, integrated attack infrastructure and a presence in DeepSeek AI chatbots.
In 2026, Qilin continued to operate as a ransomware-as-a-service (RaaS) operation. Its affiliate model offers participants up to 85% of ransom payments, and this high revenue share helps the group recruit and retain affiliates. The model has supported Qilin’s continued activity across multiple sectors and regions.
Victimology
Qilin appears to exclude organizations in Commonwealth of Independent States (CIS) countries and primarily targets organizations in the United States, Canada, Europe and other regions. Health care is a notable target sector, accounting for approximately 13.3% of identified victims. Although some ransomware operators avoid critical infrastructure and essential services to limit law-enforcement attention, Qilin’s activity shows that health care organizations remain at significant risk.
Campaign overview
Qilin operates as a ransomware-as-a-service (RaaS) operation, meaning that individual affiliates can use different methods to gain access to victims. Common approaches include targeted phishing, compromised VPN and RDP credentials, exploitation of vulnerable internet-facing applications and abuse of remote-management tools.
Once inside the network, attackers typically use legitimate administrative tools to move laterally, obtain higher privileges, disable security and recovery mechanisms, and steal sensitive data before deploying the ransomware across as many systems as possible. Qilin commonly follows a double-extortion model, combining large-scale encryption with threats to publish stolen information if the ransom is not paid.
Qilin has also been linked to several threat groups, including Moonstone Sleet and has an alleged partnership with Scattered Spider. Some Qilin operators have also established separate RaaS groups, including The Gentlemen and Securotrop. The Gentlemen became a competitor to Qilin, while Securotrop continues to operate within the Qilin affiliate network but maintains a separate data leak site.
Technical analysis
The Windows sample is a 4.69 MB PE32 executable — large for ransomware — with no resources and 6,598 identified functions. Although the PE detector could not identify the programming language, the code contains numerous references to Rust source files. Because Rust executables commonly include all linked packages, this implementation likely accounts for the sample’s relatively large size and high function count.
Command line arguments
Qilin supports a set of command-line arguments that control its execution, encryption scope, system preparation and post-encryption behavior. During initialization, the ransomware parses these arguments and stores their corresponding values in internal configuration variables. These variables are subsequently used to determine which functionality to enable or disable during execution. The following table also includes internal values that represent the default parameters used when no command-line arguments are provided.
The ‘-password’ argument is mandatory for execution. The supplied password is passed to a SHA-256 hashing function, and the resulting hash is compared against the hardcoded value:
6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2
If the calculated hash does not match the expected value, or if the -password argument is not provided, Qilin terminates its execution.
Configuration
The sample stores its configuration in JSON format, beginning with an RSA public key.
directory_black_list contains directory names that are excluded from the encryption process. The list includes Windows system directories and other locations whose encryption could impair system functionality, as well as directories associated with commonly used browsers. Excluding browser-related directories may help preserve the victim's ability to access the system and communicate with the attackers to negotiate or pay the ransom.
"windows", "system volume information", "intel", "admin$", "ipc$", "sysvol", "netlogon", "$windows.~ws", "application data", "mozilla", "program files (x86)", "program files", "$windows.~bt", "msocache", "tor browser", "programdata", "boot", "config.msi", "google", "perflogs", "appdata", "windows.old", "appdata", "..", ".", "boot", "windows", "windows.old", "$recycle.bin", "admin$"
file_black_list contains file names that are excluded from encryption. Most entries correspond to Windows system and configuration files that may be located outside the directories excluded by directory_black_list. This provides an additional layer of protection against encrypting critical system files regardless of their location.
"desktop.ini", "autorun.ini", "ntldr", "bootsect.bak", "thumbs.db", "boot.ini", "ntuser.dat", "iconcache.db", "bootfont.bin", "ntuser.ini", "ntuser.dat.log", "autorun.inf", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "#recycle", "autorun.inf", "boot.ini", "bootfont.bin", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "desktop.ini", "iconcache.db", "ntldr", "ntuser.dat", "ntuser.dat.log", "ntuser.ini", "thumbs.db", "#recycle", "bootsect.bak"
file_pattern_black_list contains file extensions and patterns that are excluded from encryption. These include executable files, scripts, drivers, Windows system components, configuration files, and other file types that may be required for system operation. The list also contains 3Tqc380bbh, which corresponds to the configured company_id and represents the ransomware's encrypted-file extension.
"themepack", "nls", "diapkg", "msi", "lnk", "exe", "scr", "bat", "drv", "rtp", "msp", "prf", "msc", "ico", "key", "ocx", "diagcab", "diagcfg", "pdb", "wpx", "hlp", "icns", "rom", "dll", "msstyles", "mod", "ps1", "ics", "hta", "bin", "cmd", "ani", "386", "lock", "cur", "idx", "sys", "com", "deskthemepack", "shs", "theme", "mpa", "nomedia", "spl", "cpl", "adv", "icl", "msu", "3Tqc380bbh"
process_black_list contains process names that are excluded from the ransomware's process-handling logic. The entries include processes associated with virtualization platforms, databases, business applications, backup software, security products and remote-access software. The presence of these entries indicates that the ransomware applies specific handling rules to selected processes rather than treating all running processes uniformly.
"vmms", "vmwp", "vmcompute", "agntsvc", "dbeng50", "dbsnmp", "encsvc", "excel", "firefox", "infopath", "isqlplussvc", "sql", "msaccess", "mspub", "mydesktopqos", "mydesktopservice", "notepad", "ocautoupds", "ocomm", "ocssd", "onenote", "oracle", "outlook", "powerpnt", "sqbcoreservice", "steam", "synctime", "tbirdconfig", "thebat", "thunderbird", "visio", "winword", "wordpad", "xfssvcon", "bedbh", "vxmon", "benetns", "bengien", "pvlsvr", "beserver", "raw_agent_svc", "vsnapvss", "cagservice", "qbidpservice", "qbdbmgrn", "qbcfmonitorservice", "sap", "teamviewer_service", "teamviewer", "tv_w32", "tv_x64", "cvmountd", "cvd", "cvfwd", "cvods", "saphostexec", "saposcol", "sapstartsrv", "avagent", "avscc", "dellsystemdetect", "enterpriseclient", "veeamnfssvc", "veeamtransportsvc", "veeamdeploymentservice", "mvdesktopservice"
win_services_black_list contains Windows service names that are excluded from the ransomware's service-handling logic. The list includes services associated with virtualization, backup and recovery software, databases, Microsoft Exchange, security software, SAP, Acronis and Veeam. Several entries use wildcard or regular-expression-like patterns, such as "(.*?)sql(.*?)", allowing the ransomware to match multiple SQL-related services.
"vmms", "mepocs", "memtas", "veeam", "backup", "vss", "sql", "msexchange", "sophos", "msexchange", "msexchange\$", "wsbexchange", "pdvfsservice", "backupexecvssprovider", "backupexecagentaccelerator", "backupexecagentbrowser", "backupexecdrivecimediaservice", "backupexecjobengine", "backupexecmanagementservice", "backupexecservice", "gxblr", "gxvss", "gxclmgrs", "gxcvd", "gxcimgr", "gxmmm", "gxvsshwprov", "gxfwd", "sapservice", "sap", "sap\$", "sapd\$", "saphostcontrol", "saphostexec", "qbcfmonitorservice", "qbdbmgrn", "qbidpservice", "acronisagent", "veeamnfssvc", "veeamdeploymentservice", "veeamtransportsvc", "mvarmor", "mvarmor64", "vsnapvss", "acrsch2svc", "(.?)sql(.?)"
Other configuration parameters contain a campaign / build identifier, execution parameters and an account entry recovered from memory. The company_id value, 3Tqc380bbh, is also present in the file-pattern blacklist and corresponds to the ransomware's file extension. The account value has been redacted in this report.
"company_id": "3Tqc380bbh"
"n": 0
"p": 1
"fast": 0
"skip": 0
"step": 0
"accounts": ["<redacted>@mills.local:<redacted>"]
It also contains ransom note text at the end of the configuration.
Mutex
Qilin creates a mutex to ensure that only one instance of the ransomware runs at a time. Hardcoded mutex value matches password hash that used earlier to validate the supplied password argument:
6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2
Process token manipulations
First, it opens the current process token using GetTokenInformation with the TokenElevationType parameter (0x14) to determine whether the binary is running with elevated administrative rights. If high-privilege execution is confirmed, execution proceeds normally. If running unprivileged, the malware checks for the --no-elevation switch. When present, it bypasses operations requiring administrative rights and continues execution. Otherwise, the payload has a console output string that will ask to execute the payload under the administrator account.
When executed with administrator privileges, the sample also adjusts its own token by enabling several privileges:
The sample also includes token impersonating logic that can be triggered with the ‘-impersonate’ argument. It obtains a process access token using OpenProcessToken and subsequently duplicates tokens using DuplicateTokenEx. The first duplication requests a primary token (TokenType = 1), while the second requests an impersonation token (TokenType = 2). Both calls request MAXIMUM_ALLOWED (0x02000000) access and use the SecurityImpersonation level (2). The resulting impersonation token is assigned to the current thread via SetThreadToken, causing subsequent operations to execute under the duplicated token’s security context.
Virtualization software
The sample checks whether the current system is a virtual machine by executing the cpuid instruction and inspecting bit 31, the Hypervisor Present value. A value of 1 indicates that the system is virtual.
This logic may serve to both detect sandboxes and identify virtual machines that are valid encryption targets for or must be terminated to access their files. The sample contains a string of virtualization platform names to identify the environment:
Microsoft HvHyper-VVMwareVMwareVMwareVBoxVBoxVBoxVirtualBoxKVMKVM
An additional VM check is performed by reading registry keys that are usually present on Hyper-V or Azure virtual machines.
SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters
If configured to target virtual machines, the sample executes a saved PowerShell script.
This script is extensive and performs the following functions:
- Install .NET Framework if not present
- Install the NuGet provider if not present
- Change PowerCLI configuration
- Disable cluster services
- Obtain a list of ESXi hosts
- Change ESXi password
- Enable ESXi SSH
- Change ESXi hosts' configurations
- Upload and execute payloads on ESXi hosts to encrypt them
Services and processes
To handle process and service termination, the binary spawns an independent execution thread. It enumerates running processes by invoking CreateToolhelp32Snapshot and iteratively checks image names against the embedded process_black_list to prevent stopping excluded binaries. Similarly, active services are validated against win_services_black_list before receiving the SERVICE_CONTROL_STOP signal via ControlService.
Final preparations
Sample calls the cpuid instruction again, this time checking the 25-bit value against 2000000h, which corresponds to the AES instruction-set extension. If this bit is set, the processor supports AES-NI instructions, allowing the malware to determine whether hardware-accelerated AES operations are available. If they are supported, it will use AES in CTR mode as the symmetric cipher; otherwise, it will use ChaCha20.
It also sets an error mode to value 1, which is SEM_FAILCRITICALERRORS, and forces the system not to display the critical-error-handler message box.
To provide auto-start, it sets a new registry key to the next path:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The key name is different each time and has the next pattern: *[6 random letters]
The value of this key will be the path of the payload, including all arguments used to execute it.
The sample modifies Windows symbolic-link evaluation settings using fsutil, enabling both Remote-to-Local (R2L) and Remote-to-Remote (R2R) symbolic-link resolution. This allows symbolic links encountered on remote resources to be resolved to local or other remote targets, potentially facilitating traversal of linked resources during the ransomware's file-processing operations.
/C fsutil behavior set SymlinkEvaluation R2R:1
/C fsutil behavior set SymlinkEvaluation R2L:1
Next, it modifies the EnableLinkedConnections policy to facilitate access to mapped network drives across elevated and non-elevated logon sessions, potentially allowing network resources available to the user to remain accessible during elevated execution:
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
The sample executes net use to enumerate existing network connections and mapped network drives, allowing available remote resources to be identified before encryption.
Before encryption, Qilin deletes all available Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet, preventing recovery of files through Volume Shadow Copy-based restoration mechanisms.
Additionally, it executes Wow64DisableWow64FsRedirection, which disables file system redirection for the calling thread. After encryption is complete, it will revert this using Wow64RevertWow64FsRedirection.
Encryption
Before starting to look for files, Qilin obtains detailed information about storage devices using next functions:
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInterfaceDetailW
GetLogicalDrives
GetDriveTypeW
WNetOpenEnumW
Following drive enumeration, the binary initiates a recursive directory traversal across the discovered volumes using a dedicated worker thread that calls FindFirstFileW and FindNextFileW. The routine strictly enforces exclusions for paths, filenames and extensions, matching them against embedded blacklists. The thread pool size allocated for encryption operations is dynamically determined by retrieving the dwNumberOfProcessors property via GetSystemInfo.
As noted earlier, when hardware acceleration is available, the payload leverages AES-CTR for file encryption using dedicated x86/x64 instructions, including aeskeygenassist, aesimc, and aesenc.
When hardware-accelerated instructions are unavailable, the payload falls back to ChaCha20 for file encryption. The binary incorporates an SSE-optimized implementation of the core ChaCha20 block routine, executing a 10-cycle loop in which each pass performs a full double-round, combining standard column and diagonal transformations.
For each file, Qilin generates a 32-byte key using BCryptGenRandom function. After encrypting the file content with that key, the ransomware encrypts the key with RSA-4096 using a hardcoded public key. It then appends the encrypted key to the encrypted file data right after a special delimiter.
Qilin appends.3Tqc380bbh extension to each encrypted file’s original name. This extension may differ between victims.
Ransom note
Qilin drops a ransom note file named *README-RECOVER-[company-id].txt in each encrypted folder on the system. The note describes the encryption, threatens to publish the stolen data if the victim does not cooperate, and warns against modifying encrypted files or using third-party recovery tools. It also claims that police or authorities cannot help obtain the encryption key. Besides blog and leak site links, it also contains a link to the threat actor's chat page with login and password credentials.
Logs
Qilin logs each execution step and outputs the entries to the console. Each entry includes the current time, elapsed time since execution began, log level and associated message.
After encryption starts, the process stops logging to the console and switches to file logging. It creates a folder ‘%AppData%\Local\Temp\QLOG’ and starts writing .txt files for each thread it runs. Those logs contain the full execution process, including the same data as the console log, as well as preparations, the file search routine and encryption.
After encryption completes, Qilin collects the log files in the QLOGS.zip archive, which the attacker can then exfiltrate.
Blog site
Qilin’s blog lists information about victims, including selected stolen files presented as evidence and each case’s publication status. The status is shown as either “Published” or as a countdown indicating how long the victim has to pay the ransom before the data is released. Although Qilin has operated since 2022, the earliest entry on the blog is dated March 21, 2025. The site also displays a QR code and a link to WikiLeakV2.
WikiLeaksV2 is a clearnet leak site associated with the Qilin ransomware operation. While it does not belong to the Qilin actors, the site is used to publish and distribute data stolen from organizations compromised by Qilin and its affiliates as part of the group's double-extortion strategy. The platform, therefore, serves as an additional publicly accessible channel for exposing stolen victim data and increasing pressure on organizations to pay the demanded ransom.
Conclusion and impact
Qilin remains one of the most active ransomware operators in the world. Its extensive configuration options allow affiliates to tailor the ransomware to their specific operational requirements. The malware can encrypt files locally, on network shares, within virtual machines and across domain environments. It also incorporates self-propagation capabilities that can enable rapid deployment across an entire network, including virtualization infrastructure.
Qilin dynamically selects encryption methods based on the compromised system's capabilities, enabling it to encrypt as efficiently as possible. Unlike many other ransomware groups, Qilin does not rely exclusively on its own data-leak infrastructure. Instead, it uses the WikiLeaksV2 site to publish stolen data when victims refuse to pay the ransom. The group also actively targets the healthcare sector, further increasing the potential impact of its operations and making Qilin a significant ransomware threat in 2026.
Detection guidance and mitigation recommendations
- Deploy and maintain an EDR or other endpoint security solution capable of detecting ransomware activity, including mass file encryption, suspicious process and service termination, security-tool tampering, credential theft and unauthorized driver loading.
- Secure VPN, RDP and other remote-access services with strong authentication, preferably phishing-resistant MFA. Restrict remote access to trusted networks or devices where possible, disable unnecessary remote-access services and monitor for unusual login activity.
- Keep operating systems, applications, network devices, security products and third-party software up to date. Apply security patches promptly, particularly for vulnerabilities in internet-facing applications that could allow attackers to gain initial access or escalate privileges.
- Monitor and restrict the use of PowerShell, remote administration tools and other utilities commonly abused by ransomware operators. Alert on unusual administrative activity, especially when these tools are used to disable security controls, modify system settings or execute commands across multiple hosts.
- Maintain regular, tested backups using access controls that prevent compromised systems from modifying or deleting backup copies. Where possible, keep critical backups isolated from the production environment and monitor for attempts to access or delete backup data.
Detection by Acronis
Acronis EDR / XDR detects and blocks this threat:
Indicators of Compromise (IOCs)
Windows (Qilin)
24a24c5fe9a5dc242b2908d020f890ed5b3afe8146fade4e3ab8a07d19007b6d
011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756
516927b55038c1702bc8a6a0262a39d5fe45f4b07527fdc42415533a9665264a
43672ef1384888922c13838f695da58f8cb9b8ad47ce896b3b7151e7edd18afb
bd1cf7823cabbac2ea7b45f2d7c9dfcd6b9a24714b6d40377bdef82b9c88021b
4f8efbfe1f94dc7c6d5547c836e56ed56b1b3c33d324bd8619b8108c572b5ca6
e81e9a3a8baca74a5c73bb5d0904cd7ac145e330c4d4993bfd671f3396402416
Windows (Securotrop)
e76fb9cf2da75e963e4d00b48500f59fa6a0e7d21915b8c54ca3d83c52b9d43b
62fd30a7841f36b389af9cf4b3230c666bf620d9f57eb3bf73a06fe86d0917ff
61820172ff5440c9e4f48695cc3551638306d06214cf72df41740dd08d734104
54f36b39e5bcee15acc530d70c173f26a1e1d7a62e866181d8a68309b4660928
Network indicators
hxxp[://]kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion
hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion
hxxps[://]wikileaks2[.]site/
meuu4pqh6g4aqjk5i6ama4dt5z365qgilwfn53iqcyrdbzkd3d4secyd[.]onion