In recent years, the name Qilin has appeared with increasing frequency in public analyses of ransomware. The available information describes it not merely as a malware family, but as a criminal ecosystem organised along service-oriented lines, in which infrastructure, tools and support are made available to affiliates involved in the campaigns. For a business, this means that ransomware should not be viewed as an isolated incident, but as the result of a chain of compromises that must be intercepted before encryption takes place.
According to available technical analyses, the operations attributed to Qilin are not limited to file encryption. Prior to the final stage, they may include initial access, internal reconnaissance, credential harvesting, data exfiltration and subsequent extortion attempts. It is during these preliminary stages that the ability to carry out continuous monitoring, correlate events and respond promptly to weak indicators of compromise becomes crucial.
Who is Qilin and why has it become so significant
Qilin, also referred to in some analyses by its previous name Agenda, has been observed since at least 2022. The rebranding to Qilin is generally believed to have taken place in the same year. Although the name evokes a creature from Chinese mythology, various elements reported by threat intelligence sources – including activity on underground forums and targeting rules – have been interpreted as consistent with a Russian-speaking criminal ecosystem. It should be noted that these attributions are based on technical indicators and public observations, not on definitive judicial identifications.
From a technical perspective, the variants analysed over time show an evolution towards more high-performance architectures that are more difficult to analyse. The earliest versions were associated with Go, whilst later versions were developed in Rust: both languages are well-suited to cross-platform compilation. One particularly significant aspect concerns the variant targeting VMware ESXi environments, a scenario which, in many incident response operations, can prove to be among the most damaging for organisations, as it directly affects virtualised infrastructure and non-Windows critical systems.
The operational model is generally attributed to Ransomware-as-a-Service. Under this model, central operators manage the malware, infrastructure and distribution channels, whilst affiliates carry out the intrusions. Known revenue-sharing arrangements typically allocate 80 per cent of the ransom to the affiliate, a percentage that can rise to 85 per cent for payments exceeding 3 million dollars: a model designed to incentivise the participation of actors already possessing operational capabilities.
Data on ransom claims confirms the group’s growing visibility. According to the analysed dataset, there are 2,223 claims in total: 182 relating to 2024, 1,040 to 2025 and 1,001 to 2026. This figure should be interpreted as an indicator of declared activity and not as a definitive measure of the actual number of incidents or organisations involved.
Claims published on leak sites do not necessarily correspond to the actual number of incidents: some activities may not be published, whilst others may be counted using inconsistent criteria or incorporated into the criminal actors’ communication strategies. Their primary value, therefore, is analytical: they help to observe trends, operational continuity and media pressure, but should not be used as absolute data.
How a Qilin attack begins
An attack attributed to Qilin does not usually begin directly with encryption. Public analyses indicate that possible entry points include compromised credentials, inadequately protected remote access services, phishing campaigns or known vulnerabilities in perimeter devices, backup platforms and exposed enterprise systems. Once access has been gained, the observed activity tends to focus on understanding the environment and identifying the most relevant systems. For this reason, visibility into access, identities and exposed assets becomes an operational prerequisite, not a secondary control.
Operators may map the network, search for critical servers, check available privileges and attempt to gain access to identity management systems. The time interval between the initial access and the actual compromise is defined as dwell time and varies depending on the case observed: some analyses report intervals of just a few days, whilst others indicate longer periods. At this stage, many activities may resemble routine administration, particularly when legitimate protocols and tools such as RDP for lateral movement, PsExec for remote execution or network scanners for internal reconnaissance are used. The key difference lies in the ability to recognise anomalous behaviour within the specific context of the organisation.
From the compromised network to the ransom demand
Prior to encryption, operations attributed to Qilin may include the exfiltration of data deemed sensitive or useful for extortion: internal documents, email archives, personal data, operational information or backups. The technical methods vary depending on the compromised environment and the capabilities of the affiliate involved.
Encryption therefore represents a final stage of the operation, not necessarily the entire attack. Pressure may also be based on the threat of publishing the stolen data or on other forms of reputational exposure. However, each case must be assessed individually, as dynamics, timelines and impacts can vary significantly.
Some sources have also described capabilities designed to increase pressure during negotiations, for example by analysing the stolen data to identify potential regulatory issues. This element should be interpreted as part of the stated or observed extortion strategy, not as an independent legal assessment of whether breaches have actually occurred.
Why Qilin is difficult to detect
The complexity lies not only in the malware itself. Qilin often exploits legitimate or readily available tools: remote administration protocols, system utilities, endpoint management software, compression tools and file transfer solutions. This makes it more difficult to distinguish malicious activity from normal administrative activity, particularly in environments that are poorly monitored or lack effective correlation between endpoints, networks, identities and user behaviour.
The techniques observed can vary significantly depending on the affiliate, the target and the defensive posture of the compromised environment. This is why it is important not to generalise: not all operations attributed to Qilin exhibit the same level of sophistication, but even activities based on common tools can become very difficult to detect if they are not correlated with identity, endpoints, the network and user behaviour.
Encryption is also designed with defensive logic to thwart analysis. The variants observed utilise hybrid cryptographic schemes, combining symmetric algorithms to quickly encrypt large amounts of data and asymmetric algorithms to protect the keys. Some binaries also require a specific launch parameter: if this is not provided or is incorrect, the malware shows no obvious activity. This is a simple yet effective way of rendering many automated sandboxes less effective.
When the destructive phase is initiated, activities aimed at limiting recovery options can be observed, such as the disruption of key services, the deletion of logs or the removal of backup copies. These are recurring behaviours in modern ransomware and are not exclusive to any single group.
Operational impact of the campaigns
Campaigns attributed to Qilin can have significant impacts, particularly in sectors where business continuity, data availability and the protection of personal information are critical. The extent of the impact, however, depends on the context: network segmentation, the quality of backups, detection times, response capabilities and the level of exposure of the systems involved. From this perspective, resilience is not merely about recovery, but about the ability to contain the attack whilst it is still underway.
The impacts are not limited to the encryption of systems. The damage stems from a combination of operational disruption, the exposure of sensitive data, public pressure and the complexity of recovery. It is this combination that makes modern ransomware so difficult to manage, especially when the attack involves identities, backups, core systems and critical processes.
Trends to watch
The latest analyses point to a number of trends to monitor: greater automation in reconnaissance, the use of tools to classify stolen data more quickly, opportunistic collaboration between criminal actors, and the possible reuse of payloads by different groups. These elements do not allow every campaign to be attributed the same level of sophistication, but they suggest an increasingly flexible and interconnected ransomware ecosystem.
What the Qilin case teaches organisations
The Qilin case confirms a broader trend: ransomware cannot be viewed solely as encryption malware. In modern operations, identities, privileges, backups, directory systems, sensitive data and virtualised infrastructure can all become part of the same risk landscape. An effective response therefore requires an integrated approach: prevention, detection, threat intelligence, incident response and risk governance must work together.
This is why prevention cannot be limited to antivirus software or backups. A broader strategy is needed, capable of reducing the attack surface, intercepting weak signals before encryption takes place, and rapidly mobilising specialist expertise when the situation demands it. The priorities are few, but crucial:
- Integrate monitoring, threat intelligence and incident response into a continuous operational model, capable of transforming alerts into rapid, context-aware decisions;
- Protect external access with phishing-resistant MFA, particularly on remote access services, cloud portals and management systems;
- Carefully monitor Active Directory, particularly changes to Group Policy Objects (GPOs), the Default Domain Policy, privileged accounts and anomalous access to Domain Controllers;
- Limit the use of remote management and administration tools by establishing clear rules on who can use them and from where;
- Isolate and protect backups, ensuring they cannot be accessed by the same compromised accounts used during the attack;
- Rapidly apply patches to exposed devices and critical systems, prioritising perimeter services, backups, remote access and enterprise platforms already known to be targeted by the group’s affiliates.
In conclusion
Qilin is considered significant not because every campaign introduces completely new techniques, but because the operations attributed to the group often combine initial access, credential harvesting, lateral movement, possible exfiltration and encryption. It is a mature attack model that exploits known and recurring weaknesses: unprotected identities, out-of-date systems, hybrid infrastructure and response processes that are not sufficiently rapid. It is precisely within this window – between the initial compromise and the final impact – that the most effective defence is played out today.
The most effective defence therefore starts with a change of perspective: do not wait for encryption, but look for early signs of intrusion, misuse of administrative tools and anomalous movements across the network. It is during this window, before the attack becomes visible, that an organisation can significantly reduce the risk of an operational, legal and reputational crisis. This means moving security away from a reactive approach and integrating it into a continuous model of protection, detection and response.
