Qilin (formerly Agenda): From emergence to global ransomware dominance

Ransomware continues to dominate the cyber threat landscape, evolving from opportunistic file-encrypting malware into structured, profit-driven criminal enterprises. Modern ransomware operations are no longer driven by lone actors. Instead, they operate under organized models with defined roles, affiliate networks, monetization strategies, and scalable infrastructure.

One of the most active and rapidly expanding ransomware groups operating under this model is Qilin.

Qilin is a Russia-based ransomware group that first emerged in 2022, initially operating under the name “Agenda.” While early activity remained relatively limited, the group gained significant momentum in 2023 and accelerated aggressively through 2024 and 2025. By late 2025, if we analyze the data from ransomware.live, Qilin has become one of the most active ransomware threats globally.

In October 2025 alone, Qilin claimed responsibility for approximately 210 victims. At the time of reporting, the group had publicly listed 1,697 victims in total and claimed 421 victims within a 90-day period, underscoring its sustained operational tempo and rapid growth trajectory.

The cumulative victim growth chart in the report highlights a clear year-over-year expansion pattern, suggesting continued operational maturity and likely persistence into 2026.

Cumulative Victims per month (source:ransomware.live)

Qilin operates under a Ransomware-as-a-Service (RaaS) model. The core operators develop and maintain the ransomware platform and supporting infrastructure, while affiliates conduct intrusions in exchange for a percentage of ransom payments.

This structure allows Qilin to:

• Scale rapidly
• Diversify attack vectors
• Expand geographically
• Maintain a high operational tempo

Over time, Qilin has evolved from a Golang-based encryptor to a Rust-based cross-platform ransomware capable of targeting Windows, Linux, and VMware ESXi systems. The affiliate panel supports customized execution, service termination, safe-mode rebooting, lateral movement, and additional extortion features.

Beyond traditional double extortion (encryption + data theft), Qilin has introduced expanded pressure tactics including DDoS extortion and a Call Lawyer negotiation feature designed to intimidate victims during ransom discussions.

Top 5 industries targeted by Qilin (source: ransomware.live)

Geographically, Qilin’s activity spans multiple regions. The United States, United Kingdom, Germany, Canada and Spain account for the highest number of reported victims, demonstrating the group’s broad international footprint.

Top 5 countries targeted by Qilin (source:ransomware.live)

Technical Analysis

Initial Access

• Exploits public-facing vulnerabilities including CVE-2024-21762 and CVE-2024-55591,.
• Conducts social engineering campaigns such as ClickFix, leading to StealC v2 malware infections.
• Gains access through leaked or stolen administrative credentials.
• Compromises VPN infrastructure where MFA is not enforced, reducing access barriers.
• Modifies Active Directory Group Policy Objects (GPOs) to enable Remote Desktop Protocol (RDP) for deeper network access.

Persistence

• Creates Registry Run keys for persistence.
• Establishes scheduled tasks.
• Creates backdoor administrative accounts.
• Modifies registry-based RDP settings to maintain remote access.

Privilege Escalation

• Uses the Windows net utility to escalate privileges by adding attacker-controlled accounts to the local Administrators group.
• Creates network shares with permissive access controls to allow unrestricted access to system files.
  
  

Defense Evasion

• Modifies symbolic link evaluation settings using fsutil.
• Clears Windows Event Logs to remove forensic traces.
• Disables AMSI protections to bypass PowerShell-based security controls.
• Uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security protections, deploying tools such as DarkKill and HRSword to terminate EDR solutions.

Credential Access

• Dumps LSASS memory to extract credentials.
• Enables WDigest to store credentials in plaintext.
• Harvests credentials from Veeam backup infrastructure
• Uses credential dumping tools such as Mimikatz and SharpDecryptPwd

Discovery

• Uses PowerShell with the ActiveDirectory module to enumerate domain-joined systems and retrieve their DNS hostnames.
• Enumerates accessible network shares and resources using Windows networking APIs such as WNetOpenEnum and WNetEnumResource.
• Performs Active Directory and domain enumeration to identify trust relationships and privileged accounts using native utilities such as nltest and net.
• Deploys network scanning tools such as Netscan to identify reachable systems and exposed services.
• Installs and abuses Remote Management Tools (RMM) including ScreenConnect and AnyDesk via Atera agents to execute discovery commands and blend activity with legitimate administrative operations.
  
  

Lateral Movement

• Uses PsExec, RDP, SSH, and Active Directory administrative tools.
• Conducts network discovery and scanning using utilities such as netscan.
• Demonstrates cross-platform capabilities, including executing Linux ransomware payloads via Windows Subsystem for Linux (WSL).
  
  

Collection

• Custom scripts leveraging SMTP to exfiltrate data via email services.
• Archives collected data using WinRAR prior to exfiltration.

Exfiltration

• Stages and exfiltrates data using:
  • Public file-sharing and cloud storage services such as easyupload[.]io used for data staging and exfiltration

Impact

• Manipulates Volume Shadow Copy Service (VSS).
• Deletes shadow copies and disables recovery mechanisms.
• Encrypts local and network-accessible files to maximize disruption.
• Renames encrypted files with .qilin or custom extensions.
• Extensions are configurable through the Qilin RaaS panel.
• Extensions often contain unique victim or company identifiers to track campaigns.
• Drops ransom notes typically named:
  • README-RECOVER.txt
  • README-RECOVER-[company_id].txt
• Notes include instructions for contacting the attackers.
  
  

Qilin Ransom Note

• provides access to the Qilin leak site hosted on a .onion address via the Tor network
• includes direct IP-based access for victims without Tor
• victims receive a unique company ID and login credentials for the negotiation portal
• modifies the desktop wallpaper to display ransom instructions directing victims to recovery steps
  
  

MITRE ATT&CK