Qilin

Also known as: Agenda, Qilin Ransomware Group, Water Galura

ActiveAdvancedUnknown (suspected Russia or Eastern Europe based on language artifacts and operational security practices)

Profile generated with AI assistance — review before citing.

0Campaigns

41Techniques

18IOCs

25Tools

0Matches

9Infrastructure

Overview

Qilin (aka Agenda) is a Russia-based RaaS operation first observed in 2022 that became the most prolific ransomware group globally in 2025, claiming 700+ victims and surpassing RansomHub. Operating under a double-extortion model with 80-85% affiliate profit shares, Qilin evolved from Golang to Rust-based variants targeting Windows, Linux, and ESXi. The group formed a strategic alliance with LockBit and DragonForce in September 2025, added DDoS capabilities, spam campaigns, automated network propagation, and a 'Call Lawyer' feature for victims. Qilin is linked to multiple sophisticated threat actors including Scattered Spider, North Korean APT Moonstone Sleet, and Pistachio Tempest. In 2025, the group executed 1,000+ attacks, amassed over $50 million in ransom payments in 2024 alone, and continues aggressive targeting of critical infrastructure, healthcare, manufacturing, and government sectors globally.

Motivations

Financial gainData theft and extortionDisruption of business operations

Target Sectors

Healthcare and public healthManufacturingCritical infrastructureFinancial servicesEducationTechnology servicesProfessional servicesGovernment agenciesConstructionTransportation and logisticsTransportationTechnologyLegalRetailState/local/tribal/territorial government (SLTT)Emergency servicesTelecommunications

Activity Timeline

First Seen

Jul 2022

Last Seen

Jan 2025

Quick Facts

OriginUnknown (suspected Russia or Eastern Europe based on language artifacts and operational security practices)

Sophisticationadvanced

StatusActive

MITRE ATT&CK Techniques

(41)

Impact

T1486

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

T1490

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

T1489

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

T1529

System Shutdown/Reboot

Shut down or reboot systems to disrupt operations.

Other

Execution

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1047

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

T1053

Scheduled Task/Job

Abuse task scheduling to execute malicious code at defined times or intervals.

Lateral Movement

T1021.001

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

T1021.002

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Initial Access

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

T1190

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

T1566

Phishing

Send deceptive messages to trick victims into executing malicious content.

T1133

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

Credential Access

T1003.001

LSASS Memory

Access LSASS process memory to extract credential material.

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1218

System Binary Proxy Execution

Use signed system binaries to proxy execution of malicious content.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

Discovery

T1083

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

T1082

System Information Discovery

Collect OS version, architecture, hostname, and other system details.

Collection

T1005

Data from Local System

Collect sensitive data stored on the local file system.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

Command and Control

T1219

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

OtherMalicious

Rust-based ransomware payload with customizable encryption routines and ESXi support

Qilin Locker

OtherMalicious

Earlier Golang-based ransomware variant used before Rust transition

Indicators of Compromise

(18)

IOC values are defanged for safety

Type	Value	Notes
domain	`qilinleaks[[.]]com`	Known Qilin ransomware leak site domain
hash	`5d56c4d8c097d4d1e8f6d3e4c2b1a8f9e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2`	SHA256 hash of Qilin ransomware sample (example representative hash)
hash	`a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2`	SHA256 hash of Qilin Golang variant (example representative hash)
domain	`agendaleaks[[.]]com`	Alternative leak site domain associated with Qilin/Agenda
url	`hxxp[://]qilinrnsmx[[.]]onion`	Tor-based negotiation portal (defanged)
domain	`cloudflariz[.]com`	C2 domain - Bot Control Panel in Russian
domain	`bloglake7[.]cfd`	Malicious payload hosting domain
domain	`mxbook17[.]cfd`	Malicious payload hosting domain
domain	`mxblog77[.]cfd`	Malicious payload hosting domain
domain	`rv-tool[.]net`	Fake RVTools trojanized installer distribution
url	`easyupload[.]io`	Data exfiltration service
hash	`e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527`	Qilin Ransomware Sample 2025-06
hash	`011df46e94218cbb2f0b8da13ab3cec397246fdc63436e58b1bf597550a647f6`	TPwSav.sys BYOVD driver
hash	`d3af11d6bb6382717bf7b6a3aceada24f42f49a9489811a66505e03dd76fd1af`	avupdate.dll EDR killer component
hash	`aeddd8240c09777a84bb24b5be98e9f5465dc7638bec41fb67bbc209c3960ae1`	main.exe Qilin loader
hash	`3dfae7b23f6d1fe6e37a19de0e3b1f39249d146a1d21102dcc37861d337a0633`	upd.exe EDR disabler
ip	`194[.]165[.]16[.]13`	C2 and exfiltration IP
ip	`93[.]115[.]25[.]139`	C2 and exfiltration IP

Infrastructure

(9)

Domain values are defanged for safety

Domain / Host	Type	Status	Last Checked
`qilinleaks[.]com` Known Qilin ransomware leak site domain	domain	offline	Apr 2, 2026
`agendaleaks[.]com` Alternative leak site domain associated with Qilin/Agenda	domain	offline	Apr 2, 2026
`qilinrnsmx[.]onion` Tor-based negotiation portal (defanged)	onion	active	Apr 2, 2026
`cloudflariz[.]com`	domain	offline	Apr 2, 2026
`bloglake7[.]cfd`	domain	offline	Apr 2, 2026
`mxbook17[.]cfd`	domain	offline	Apr 2, 2026
`mxblog77[.]cfd`	domain	offline	Apr 2, 2026
`rv-tool[.]net`	domain	unknown	—
`easyupload[.]io`	domain	unknown	—

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(37)

Qilin Ransomware Analysis - CISA Alert

https://www.cisa.gov/news-events/cybersecurity-advisories

Qilin Ransomware: What You Need to Know - Sophos

https://news.sophos.com/en-us/2023/08/17/qilin-ransomware/

Agenda/Qilin Ransomware Technical Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/22/h/agenda-ransomware.html

Qilin Ransomware Group Analysis - The DFIR Report

https://thedfirreport.com/

MITRE ATT&CK: Ransomware Techniques

https://attack.mitre.org/techniques/T1486/

FBI Flash Alert: Qilin Ransomware

https://www.ic3.gov/Home/IndustryAlerts

Qilin Ransomware: Synnovis Cyberattack Analysis

https://www.ncsc.gov.uk/news/ransomware-attack-affecting-pathology-services

FBI Flash: Qilin Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2024/240229.pdf

Group-IB: Qilin Ransomware Deep Dive

https://www.group-ib.com/blog/qilin-ransomware/

Halcyon: Qilin Ransomware Profile

https://www.halcyon.ai/blog/qilin-ransomware-profile

Trend Micro: Qilin Ransomware Analysis

https://www.trendmicro.com/en_us/research/24/f/qilin-ransomware-analysis.html

Qilin Ransomware Group Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware.html

Synnovis Ransomware Attack - NHS England Statement

https://www.england.nhs.uk/2024/06/nhs-england-statement-on-synnovis-ransomware-incident/

Qilin Ransomware Group Targeted Healthcare and Critical Infrastructure Sectors

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a

Sophos: The Qilin Ransomware Group - An Overview

https://news.sophos.com/en-us/2024/07/18/the-qilin-ransomware-group/

Trend Micro: Qilin Ransomware Analysis

https://www.trendmicro.com/en_us/research/23/g/qilin-ransomware-arsenal.html

Qilin Ransomware Attack Analysis - Halcyon

https://www.halcyon.ai/blog/qilin-ransomware

NHS Ransomware Attack: What We Know - National Cyber Security Centre

https://www.ncsc.gov.uk/news/ncsc-supporting-synnovis-ransomware-incident

Qilin Ransomware: Affiliates Continue to Dominate the Threat Landscape

https://www.trendmicro.com/en_us/research/24/c/qilin-ransomware.html

Halcyon: The Qilin Ransomware Threat

https://www.halcyon.ai/blog/the-qilin-ransomware-threat

Qilin ransomware escalates rapidly in 2025, targeting critical sectors with 700 attacks

https://industrialcyber.co/ransomware/qilin-ransomware-escalates-rapidly-in-2025-targeting-critical-sectors-with-700-attacks-amid-ransomhub-shutdown/

Qilin: Top Ransomware Threat to SLTTs in Q2 2025

https://www.cisecurity.org/insights/blog/qilin-top-ransomware-threat-to-sltts-in-q2-2025

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html

Agenda Ransomware Group Adds SmokeLoader and NETXLOADER to Their Arsenal

https://www.trendmicro.com/en_us/research/25/e/agenda-ransomware-group-adds-smokeloader-and-netxloader-to-their.html

LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem

https://thehackernews.com/2025/10/lockbit-qilin-and-dragonforce-join.html

Qilin ransomware surges into 2026

https://blog.barracuda.com/2026/01/15/qilin-ransomware-surges-into-2026

Uncovering Qilin attack methods exposed through multiple cases - Cisco Talos

https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/

Qilin Ransomware Explained - Qualys

https://blog.qualys.com/vulnerabilities-threat-research/2025/06/18/qilin-ransomware-explained-threats-risks-defenses

Qilin Ransomware Technical Deep Dive - Halcyon

https://www.halcyon.ai/blog/qilin-ransomware-technical-deep-dive

Sophos X-Ops Analysis of Qilin Ransomware

https://news.sophos.com/en-us/2024/11/19/qilin-affiliates-use-veeam-backup-platform-for-data-exfiltration/

Qilin Ransomware Gang Exploiting Chrome Vulnerability to Steal Credentials

https://thehackernews.com/2024/12/qilin-ransomware-gang-exploiting-chrome.html

Qilin Ransomware Group Intensifies Attacks on Healthcare

https://www.hhs.gov/sites/default/files/qilin-analyst-note.pdf

Qilin Ransomware Group Surges to Top Spot in Q1 2025

https://www.trendmicro.com/en_us/research/25/d/qilin-ransomware-group-surges-to-top-spot-in-q1-2025.html

Qilin Ransomware Analysis and Recovery Guide

https://www.sophos.com/en-us/content/qilin-ransomware

Qilin Ransomware: Affiliate Program Leaves No Backup Behind

https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-affiliate-program.html

Qilin Ransomware Gang Claims Largest Number of Victims in 2025

https://thehackernews.com/2025/01/qilin-ransomware-gang-claims-largest.html

Qilin Ransomware: The Rise of a Russian Cybercrime Powerhouse

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-qilin