Qilin

Description

Qilin (a.k.a. Agenda) is a ransomware as a service operation first observed in July 2022, and its name references a Chinese mythological creature symbolizing power and prosperity despite the group's links to Russian speaking cybercriminals. Its tooling includes Go and Rust variants that encrypt Windows, Linux, and VMware ESXi systems, and its affiliates have targeted organizations worldwide, with the majority of victims in the United States, France, Canada, and the United Kingdom, primarily in manufacturing, technology, financial services, and healthcare.

Stats

First seen: October 2023
Last seen: October 2026

Also known as

Agenda

MITRE ATT&CK techniques

52 techniques across 11 tactics.

TA0001 Initial Access

T1190Exploit Public-Facing Application
T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.001PowerShell
T1106Native API
T1204User Execution
- T1204.001Malicious Link
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.004Winlogon Helper DLL
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1070Indicator Removal
- T1070.004File Deletion
T1134Access Token Manipulation
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1678Delay Execution

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory

TA0007 Discovery

T1007System Service Discovery
T1012Query Registry
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1057Process Discovery
T1069Permission Groups Discovery
- T1069.002Domain Groups
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.001Local Account
- T1087.002Domain Account
T1135Network Share Discovery
T1673Virtual Machine Discovery
T1680Local Storage Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares
- T1021.004SSH
T1570Lateral Tool Transfer

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.002File Transfer Protocols
T1219Remote Access Tools
- T1219.002Remote Desktop Software

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1491Defacement
- T1491.001Internal Defacement
T1529System Shutdown/Reboot

TA0112 Defense Impairment

T1112Modify Registry
T1222File and Directory Permissions Modification
T1484Domain or Tenant Policy Modification
- T1484.001Group Policy Modification
T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs
T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs
T1688Safe Mode Boot

Associated groups

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Agenda.1	AV
Gen:Variant.Ransom.Qilin.1	AV
Gen:Variant.Ransom.Qilin.18	AV
Gen:Variant.Ransom.Qilin.21	AV
Gen:Variant.Ransom.Qilin.3	AV
Gen:Variant.Ransom.Qilin.4	AV
Gen:Variant.Ransom.Qilin.7	AV
Gen:Variant.Ransom.Qilin.9	AV
Linux.Ransomware.Qilin	ATP Sandbox Adv. Heuristics
Trojan.Linux.Ransom.Qilin.1	AV
Trojan.Linux.Ransom.Qilin.3	AV
Trojan.Ransom.Qilin.A	AV
Trojan.Ransom.Qilin.D	AV
Win32.Ransomware.Agenda	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Qilin	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Agenda	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Qilin	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Ransomware.Agenda variant binary download attempt	IPS-SWG
MALWARE-OTHER Win.Ransomware.Qilin download attempt	IPS-SWG