Qilin

MITRE ATT&CK: S1242 View on attack.mitre.org

Aliases: Agenda, Qilin

First seen
2022-01-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
esxi, windows, linux
Related IoCs
69 (67 malicious)
Last IoC activity
2026-10-11 17:47:43
Profile updated
2026-07-07 13:18:39

Targeted industries: manufacturing technology-and-telecommunications financial-services healthcare-and-pharmaceutical

Targeted regions: country_code:us country_code:fr country_code:ca country_code:gb

Context

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.

Recent IoC activity

67 malicious indicators in Maltiverse are attributed to Qilin (S1242). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample jaffacakes118_samples.part035.rar 2026-10-11 1
file sample jaffacakes118_samples.part020.rar 2026-10-11 1
file sample jaffacakes118_samples.part013.rar 2026-10-11 1
hostname vx-underground.org 2026-10-09 2
file sample 2026-03-15_0070ac173a50201adae1dd3fc74d778d_akira_amadey_darkgate_elex_glassw... 2026-10-08 1
file sample 26fa042ff7572ccb31c9600390848245ea435a9ca9980206f9e35706b4cc0362 (2) 2026-09-29 1
file sample 2026-09-27_30ac2d88c14f8176e2caa86931a919b4_akira_amadey_darkgate_elex_glassw... 2026-09-28 1
file sample 2026-09-25_34554b65a86ac99c9954eff77974d7a5_bashlite_glassworm_mirai_revil 2026-09-26 1
file sample e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.7z 2026-09-18 1
file sample 2026-09-01_9a0843e6007ac790af9505d3fb32cad8_glassworm_revil 2026-09-12 1
file sample jaffacakes118_6bd5cf39ff5c3940813a6329901769ab7512ff09c3a7387a4642026f74050e1f 2026-09-10 1
file sample 2026-09-04_43c66d628da1275b43dbd0a7d65892bb_akira_amadey_darkgate_elex_glassw... 2026-09-05 1
file sample 2026-09-04_45366c289b05f2838d20a7f38dbd23a7_akira_amadey_darkgate_elex_glassw... 2026-09-05 1
file sample 2026-09-04_56549ef5f4b5dbe159ff491ec829be72_akira_amadey_darkgate_elex_glassw... 2026-09-05 1
file sample 2026-09-04_8183374c390e16e53ad10a1e36224dc1_akira_amadey_darkgate_elex_glassw... 2026-09-05 1
file sample 2026-09-04_bf45eb9cb4aefcff77e9db878f9c5fb1_akira_elex_glassworm_qilin 2026-09-04 1
file sample 61f7aa918b55238278a1666cb723df9e3639d229d1027611e02ae3808ede33ed.zip 2026-09-04 1
file sample ransomware_notes-main.zip 2026-09-04 1
file sample CheckQilin.exe 2026-09-01 2
file sample 2026-05-10_bb66788e24c386616c891dcf8b9ef1bb_akira_amadey_elex_glassworm_luca-... 2026-08-31 1

Detection coverage

  • 1 YARA rules
  • 999 Sigma rules

Malware & tools used

  • Access Token Manipulation (attack-pattern)
  • Mutual Exclusion (attack-pattern)
  • Winlogon Helper DLL (attack-pattern)
  • System Shutdown/Reboot (attack-pattern)
  • File Transfer Protocols (attack-pattern)
  • Local Account (attack-pattern)
  • Service Stop (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Native API (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Virtual Machine Discovery (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • Execution Guardrails (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Process Discovery (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Modify Registry (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)
  • Dynamic-link Library Injection (attack-pattern)
  • Windows Command Shell (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Ransomware_Win_Agenda (yara-rule)

Reports & references

  • blog.bushidotoken.net — Tracking Adversaries Qilin Raas (report)
  • news.sophos.com — Sophos Mdr Tracks Ongoing Campaign By Qilin Affiliates Targeting Screenconnect (report)
  • Microsoft — Re54L7V (report)
  • ransomlook.io — Qilin (report)
  • sentinelone.com — Crimeware Trends Ransomware Developers Turn To Intermittent Encryption To Evade Detection (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Qilin (report)
  • research.checkpoint.com — Iranian Mois Actors The Cyber Crime Connection (report)
  • x.com — 1897738961348374621 (report)
  • medium.com — Qilin Ransomware As A Service Threat Analysis And Strategic Outlook Daf8Bd6808B5 (report)
  • tehtris.com — Rage Against The Powershell Qilin In The Name (report)
  • twitter.com — 1724521714845937822 (report)
  • bleepingcomputer.com — Linux Version Of Qilin Ransomware Focuses On Vmware Esxi (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Agendacrypt (report)
  • Trend Micro — Iocs Blog New%20Golang%20Ransomware%20Agenda%20Customizes%20Attacks.Txt (report)
  • Trend Micro — New Golang Ransomware Agenda Customizes Attacks (report)
  • Trend Micro — Agenda Ransomware Uses Rust To Target More Vital Industries (report)
  • MITRE ATT&CK — S1242 (report)
  • sentinelone.com — Agenda Qilin (report)
  • Trend Micro — Agenda Ransomware Deploys Linux Variant On Windows Systems (report)

External references