Qilin (formerly Agenda): From emergence to global ransomware dominance

Defender’s guidance and best practices

As Qilin continues to expand its operations, organisations must take a proactive and layered approach to defence. Modern ransomware campaigns combine social engineering, credential abuse, lateral movement and data exfiltration to maximise impact. The following best practices help strengthen resilience:

• conduct regular security awareness training focused on phishing and social engineering techniques. Establish a clear reporting process so suspected incidents can be escalated quickly
• keep systems, applications and infrastructure up to date with timely patching. Enforce strong password policies aligned with modern standards and require multi-factor authentication (MFA), particularly for remote access and privileged accounts
• monitor for unauthorised account creation, privilege escalation and unexpected modifications to administrative groups
• combine endpoint protection, SIEM monitoring, network segmentation, identity controls and email/web filtering to detect and prevent attacks at multiple stages
• maintain a documented and tested incident response plan. Conduct regular tabletop exercises to validate readiness and improve coordination
• follow the 3-2-1 backup strategy and maintain at least one offline or immutable backup to prevent ransomware from encrypting recovery data
• ensure comprehensive logging is centralised in your SIEM and deploy network detection capabilities to identify command-and-control activity and lateral movement

By combining people-focused awareness with strong technical controls and operational preparedness, organisations can significantly reduce the likelihood and impact of ransomware incidents like Qilin.

**All new detection rules are available as part of Guardsix’s latest release, as well as through our Servicedesk.