Loading story…
Qilin, also known as Agenda, has compromised more than 150 organizations across 25 countries, according to Group-IB. The ransomware-as-a-service operation, first identified in July 2022, attacked pathology provider Synnovis, demanding $50 million and significantly disrupting services at several NHS hospitals in London. Group-IB’s incident-response findings describe initial access through vulnerable Fortinet devices and exploitation of CVE-2023-27532 in internet-facing Veeam Backup & Replication installations to obtain credentials.
Qilin uses token theft to escalate privileges, clears event logs, disables selected processes and services, and supports propagation through PsExec and VMware vCenter. It destroys recovery options and encrypts local and network data using AES-256 CTR or ChaCha20, protecting encryption keys and nonces with RSA-4096. These techniques underscore the need to patch exposed Fortinet and Veeam systems, restrict administrative access to backup and virtualization infrastructure, maintain isolated recovery copies, and monitor for token theft, log clearing, and unexpected remote execution.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Qilin began advertising its ransomware-as-a-service operations on underground forums in February 2023.
Qilin, also known as Agenda ransomware, was first identified in July 2022.
Group-IB published incident-response findings showing Qilin operators exploiting vulnerable Fortinet devices and CVE-2023-27532 in Veeam to obtain access and credentials. The analysis also detailed token theft, log clearing, PsExec and vCenter propagation, backup destruction, and encryption mechanisms.
Qilin attacked pathology services provider Synnovis and demanded a $50 million ransom. The attack significantly disrupted several NHS hospitals in London.
Horizon3 and sfewer-r7 published proof-of-concept exploits for CVE-2023-27532 in Veeam Backup & Replication. Group-IB found no confirmed evidence that Qilin operators used those particular exploits.
Qilin evolved from the Go-based Agenda ransomware and was subsequently redeveloped in Rust.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Qilin ransomware group, also known as Agenda, has adopted a sophisticated cross-platform attack strategy by deploying Linux-based ransomware binaries on Windows systems. This technique leverages legitimate remote management and file transfer tools such as Splashtop, WinSCP, AnyDesk, ATERA RMM, ScreenConnect, and MeshCentral to bypass traditional Windows-centric endpoint detection and response (EDR) solutions. Attackers gain initial access through social engineering, including fake CAPTCHA pages, and use credential theft to facilitate lateral movement and privilege escalation. The group also employs Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security defenses and steals backup credentials, particularly from Veeam, to prevent recovery and maximize extortion leverage. Qilin's operations have impacted over 700 victims globally since January 2025, with a focus on sectors such as manufacturing, professional and scientific services, and wholesale trade. The group uses a double-extortion model, exfiltrating sensitive data with tools like Cyberduck before encrypting files and threatening public disclosure. Qilin's affiliates have been observed using a variety of post-exploitation tools, including Mimikatz and custom scripts, to harvest credentials and exfiltrate data. The group's rapid evolution and ability to evade detection highlight the growing sophistication of ransomware-as-a-service (RaaS) operations targeting organizations worldwide.
Jun 29, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
The Qilin ransomware group has emerged as one of the most prolific ransomware operations, claiming responsibility for over 500 attacks in the past six months and targeting major organizations worldwide. Notably, Qilin has allegedly stolen 10 GB of data from International Game Technology (IGT), a multinational provider in the gaming and fintech sectors, with over 21,000 files reportedly exfiltrated. The group has also targeted other high-profile victims, including Cornerstone Staffing Solutions, Spark Power, and Habib Bank AG Zurich, and is known to collaborate with other ransomware operations such as DragonForce and LockBit. Qilin, along with Akira and INC, accounted for 65% of ransomware attacks in Q3 2025, with a significant portion of these incidents facilitated by compromised VPN credentials. Ransomware activity has seen a marked increase globally, with leak posts rising by 11% over the previous quarter and a surge in attacks reported in October. Attackers are increasingly exploiting vulnerabilities in VPNs and external services, and the prevalence of zero-day vulnerabilities has also grown, with notable bugs affecting Citrix NetScaler, CrushFTP, and Microsoft SharePoint. Security experts recommend organizations implement multi-factor authentication and strengthen vulnerability management practices to mitigate the escalating ransomware threat landscape.
Jun 29, 2026