Qilin ransomware: what your security team needs to know

Qilin ransomware is now one of the most active and dangerous ransomware-as-a-service (RaaS) operations in the world. According to our latest data, the group claimed 1,403 victims between July 2025 and June 2026. That is an average of 117 victims every single month.

Why are they growing so fast? They use sophisticated detection evasion techniques and double extortion tactics. Qilin is also very popular among affiliates because the ransom payouts are high, and the group offers solid tech and negotiation support.

This article explores how Qilin works, how to identify an attack, which industries are at risk, and how to protect your organization.

Key takeaways

• Qilin, also known as Agenda, is a ransomware-as-a-service (RaaS) operation that has become a top-tier threat.
• The group uses double extortion. It steals data before encrypting it, and then threatens to leak it if the ransom isn’t paid.
• Common entry points include phishing emails, stolen VPN credentials, and unpatched vulnerabilities in internet-facing systems.
• Qilin often attacks small and medium-sized organizations in the healthcare, construction, engineering, and professional services industries.
• Defending against Qilin starts with shrinking your attack surface. You should monitor the dark web for stolen credentials, enforce phishing-resistant MFA, and patch exposed systems.
• Early detection of compromised credentials and exposed infrastructure can help reduce the risk of a Qilin attack.

What is Qilin ransomware?

Qilin ransomware is a ransomware-as-a-service operation that leases its malicious technology to other hackers, known as affiliates, who carry out their own ransomware attacks. Also known by its former name, Agenda, this ransomware group is notorious for using double extortion. This is a tactic where data is exfiltrated before it is encrypted. After that, the attackers threaten a victim organization to publish the stolen data on one of the group’s leak sites hosted on Tor.

“The Qilin ransomware group executed 299 attacks in the first quarter of 2026 alone. That translates to roughly one new victim every 7 hours,” says Mantas Sabeckis, Senior Threat Intelligence Analyst at Nord Security.

Why is Qilin ransomware so effective? Mostly because affiliates receive up to 85% of the ransom and have access to advanced infrastructure. Qilin is written in Golang and Rust, programming languages known for their cross-platform capabilities. This makes the ransomware technology highly customizable and compatible with different operating systems, including Linux and Windows.

How Qilin ransomware attacks work

Mantas Sabeckis says the Qilin group follows a methodical attack plan, which they constantly adapt:

“Negotiation data shows the group’s disciplined double extortion playbook, which includes proof-of-life decryption, financially calibrated demands, staged deadline pressure, and data leak threats.”

Here is how the attack unfolds:

Initial access

Threat actors look for the easiest way into a company’s network. This usually means exploiting existing vulnerabilities in remote access tools or using stolen credentials.

Common entry methods that Qilin uses include:

• Phishing emails with malicious attachments or links
• Exposed or weak remote desktop protocol (RDP) configurations
• Infostealer malware, which usually targets credentials saved in Google Chrome
• Multi-factor authentication (MFA) bombing
• Using compromised accounts to access a company’s virtual private network (VPN)

Detection evasion

Once the Qilin attackers gain access to the network, they don’t just encrypt data right away. They take time to hide their activity from the security team using:

• Obfuscation techniques. Threat actors “pack” the code to disguise the malware, so security tools can’t detect it. They also use code obfuscation methods, such as changing control flows, encrypting strings, and renaming functions.
• Anti-analysis techniques. Attackers detect and disable debugging and sandbox environments, which makes it very hard for security researchers to analyze their behavior.

Privilege escalation and lateral movement

At this stage, cybercriminals explore the network and escalate their privileges to gain administrative control over the entire system.

They do this by using legitimate tools like PowerShell alongside credential theft tools like Mimikatz, which can make the attackers’ movements harder to spot. This lets them reach domain controllers, backup systems, and virtualization hosts completely unnoticed.

Data exfiltration

When the attackers get high-level access to a network, they start searching for sensitive data. They steal it without encrypting it first.

Qilin attackers use tools like WinSCP or Rclone to quietly upload your data to their own infrastructure. Once they have your data, they threaten to leak it. This way, they can dictate the terms of the ransom negotiations, especially if the stolen data is regulated, legally sensitive, or operationally valuable.

Encryption and double extortion

After the stolen data is on the attackers’ servers, they trigger the final phase: encryption. First, they delete volume shadow copies so the victim company can’t restore its files.

Then, Qilin uses algorithms such as AES-256 or ChaCha20 to encrypt the files. Finally, it encrypts the file encryption key with an RSA public key, which only the attackers can unlock with their private key.

Ransom demand

Once the encryption is done, cybercriminals display a ransom demand. Mantas Sabeckis says that they are very skilled manipulators:

“Qilin’s negotiation data reveals a very calculated tactic. The group often offers 10% ransom discounts disguised as ‘goodwill.’ Their arguments adapt to the victim and vary from patient safety when targeting a healthcare organization to a company’s difficult financial situation. This level of psychological manipulation shows just how sophisticated their negotiation techniques are.”

The process usually includes:

• A ransom amount, usually in Bitcoin or Monero
• Instructions on how to contact the attackers via dark web portals or encrypted messaging services
• Threats to leak the data

However, paying the ransom does not guarantee anything. There is no promise that the attackers won’t leak the data or that the decryption key will work. This is why this double-extortion ransomware is such a threat to all businesses.

Key indicators of compromise (IoCs) for Qilin ransomware

Technical and behavioral IoCs vary across Qilin campaigns.

1. Technical indicators

• Encrypted file extension. Qilin often renames files with an extension configured for a specific victim.
• Ransom note. It appears in encrypted directories. Its file name and contents may differ between variants.
• Registry activity. Watch for unexpected scheduled tasks, RunOnce entries, or changes to Winlogon.
• Driver loading. If you see signed or vulnerable drivers that don’t belong there, it may be an attempt to bypass security.
• LSASS memory access. Qilin uses the Mimikatz module to dump LSASS memory and steal passwords.
• File transfer tools. Unexpected use of WinSCP or Rclone is a major warning sign of data theft.
• Virtualization. Watch for Qilin-compatible binaries on Linux, vCenter, or ESXi systems, especially alongside unusual SSH activity.

2. Behavioral indicators

• Anomalous remote access. VPN, RDP, SSH, or remote management access from unfamiliar devices, locations, accounts, or at unusual hours.
• Privileged identity abuse. There is abnormal domain administrator activity from workstations that do not normally perform admin tasks.
• Recovery disruption. Deletion of volume shadow copies, backup catalogs, VM snapshots, or other recovery resources near ransomware deployment.
• Service termination. Automated termination or disabling of security tools, backup agents, database services, or other tools that could block encryption.
• Vulnerable driver abuse. Loading a signed but vulnerable driver outside the established baseline, particularly when followed by the termination of security tools or elevated execution.

Industries and organizations impacted by Qilin: an overview

Qilin hits organizations all over the world, but its focus is on small and medium-sized companies in the United States. Mantas Sabeckis notes that 67% of the impacted organizations employ fewer than 200 people. The United States accounts for 40% of total global victims, followed by Canada and Western Europe.

The number of victims from July 2025 to June 2026 (Source)

High-value commercial sectors

From an industry perspective, Qilin usually attacks companies in sectors where operational downtime is costly, such as:

• Manufacturing. This is Qilin’s favorite industry. Because manufacturing companies rely on tightly scheduled supply chains, they feel the most pressure to pay the ransom.
• Construction and engineering. Disrupting operations creates immense pressure for organizations to pay quickly.
• Business services. They have a lot of intellectual property and sensitive client data, which makes them lucrative targets for extortion.

Demographics of Qilin victims from July 2025 to June 2026 (Source)

Why is Qilin ransomware more dangerous than other ransomware groups?

Qilin combines a smart business model with advanced technology. There are a few reasons why the group poses such a threat.

Qilin’s RaaS model is attractive for many affiliates

The group’s operators keep their technology updated, while the affiliates carry out the attacks. This means companies can’t just look for one pattern in Qilin’s modus operandi. The attackers may use different initial access methods, supporting tools, ransom notes, and file extensions.

It can encrypt several operating systems

Qilin has variants written in Go and Rust that can target Windows, Linux, and VMware ESXi systems. This cross-platform capability lets affiliates attack employee endpoints, servers, virtual machines, and the infrastructure that hosts them.

Credential theft can prolong an incident

Some Qilin attackers use scripts to steal credentials stored in Google Chrome. They may obtain usernames, passwords, and other authentication data before they deploy the ransomware. It means that, even when you restore your systems, the threat actors may still have access to your network. That’s why organizations should reset passwords, revoke active sessions, and rotate any exposed credentials after an attack.

Qilin attacks data, operations, and recovery options

Because the group uses double extortion, they hit companies from many angles and create several problems at once:

• Unavailable systems
• Exposed data
• Unusable backups
• Business continuity interruption
• Pressure from the attacker

What to do after a Qilin ransomware attack

If you suspect you’ve been attacked, you need to move fast and ensure that you don’t destroy the evidence. Your incident response plan should address both ransomware encryption and possible credential or data theft.

1. Contain the affected systems. Disconnect the infected devices from the network, but avoid turning them off unless you have to (there is an immediate safety or business risk).
2. Determine the scope of the attack. Identify the affected endpoints, servers, VMware hosts, cloud services, network shares, administrator accounts, and backup systems. Check the entire environment, not just the encrypted devices.
3. Assess credential exposure. Check whether attackers accessed LSASS memory, browser password stores, session cookies, privileged accounts, VPN credentials, API keys, or service accounts.
4. Preserve the evidence. Keep ransom notes, logs, memory captures, suspicious files, command histories, authentication records, and network telemetry. Record each response action and its time.
5. Engage the incident response, legal, and insurance teams. Contact external incident response specialists and notify the cyber insurance provider according to the policy terms. Legal counsel can help assess reporting duties, sanctions risks, privacy requirements, and communication with law enforcement.
6. Treat ransom negotiations as a controlled process. Use qualified specialists in law, incident response, and negotiation. Our ransomware negotiation report explains common pressure tactics, discounts, and patterns found in negotiation transcripts.
7. Check for stolen and published data. Determine which data the attackers accessed and whether Qilin has listed your organization on its leak site. Use the results of this assessment to support legal notifications, customer communication, and identity protection measures.
8. Recover from verified, clean backups. Remove attacker access, close the initial entry point, rebuild compromised systems, and validate backups before restoration. Increased monitoring should remain in place after recovery because attackers may retain credentials or other access routes.

Protect your organization against Qilin ransomware attacks

No single security tool can stop every Qilin affiliate. You need a few layers of security.

Reduce your external attack surface

Maintain an accurate inventory of all internet-facing systems, including VPN gateways, remote desktop services, firewalls, web applications, cloud assets, admin panels, APIs, and forgotten subdomains.

An attack surface management solution can help you identify all internet-exposed assets, including forgotten subdomains and shadow IT. This will give your security team guidance for fixing the most urgent vulnerabilities.

Detect stolen credentials and infostealer records

Use dark web monitoring tools to detect compromised credentials that attackers may use to get access to your systems. If an employee’s password shows up in a leak, reset it immediately and check their account for abnormal activity.

Require MFA for remote and privileged access

Multi-factor authentication (MFA) reduces the risk of a stolen password providing access to your assets.

Enforce phishing-resistant MFA for VPNs, remote desktop services, cloud applications, email, admin accounts, and critical business systems.

Patch public-facing systems quickly

Update your remote access tools, firewalls, web applications, and other systems exposed to the internet. Qilin affiliates often gain access through exposed applications and interfaces, including Citrix and RDP environments. Use threat intelligence tools to identify actively exploited flaws. If you can’t patch something right away, use other mitigations or turn the service off.

Keep corporate passwords out of browser storage

Do not let your employees store business passwords in their browsers. Qilin specifically targets those saved in Google Chrome.

Use a reliable business credential manager like NordPass that protects credentials in an encrypted vault and supports access controls, MFA, and secure password sharing. Also, disable browser password storage through managed policies where possible.

Limit lateral movement and isolate backups

Segment your network. Restrict administrative protocols, such as RDP, SMB, SSH, WinRM, and VMware management access, to authorized users and devices only.

Keep your backups on a separate domain and use different passwords for each one. Also, keep an offline copy that the ransomware can’t affect.

Track Qilin activity outside your network

Threat intelligence solutions help your security teams identify your company’s leaked credentials, active session cookies, infostealer infections, and exposed data. Dark web monitoring may also reveal whether Qilin or another ransomware group is discussing your organization on the dark web.

Contact our sales team to learn how Nordlayer Intelligence can help you protect your organization from a Qilin attack.

Disclaimer: This article is for informational purposes only. It does not constitute a guarantee of security. The data used in the article is based on discussion trends in deep and dark web spaces.