OTX-6ae185cf23690a9648c6f503 info

Description

Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims. The operation employs a flexible platform allowing affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure. Affiliates typically gain initial access through phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group follows a double-extortion model, encrypting systems while threatening to publish stolen data via their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack affecting UK healthcare services. Qilin has been linked to Moonstone Sleet and Scattered Spider, with some operators creating derivative operations including The Gentlemen and Securotrop, the latter maintaining affiliate status while operating an independent leak site. Pulse contains 23 indicator(s) (IOCs). View on OTX to inspect.

Indicators of Compromise (23)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• OTX pulse AlienVaulkt OTX

  Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims. The operation employs a flexible platform allowing affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure. Affiliates typically gain initial access through phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group

• reference AlienVaulkt OTX

• Uncovering Qilin attack methods exposed through multiple cases
  web:blog.talosintelligence.com

  Cisco Talos investigated the Qilin ransomware group, uncovering its frequent attacks on the manufacturing sector, use of legitimate tools for credential theft and data exfiltration, and sophisticated methods for lateral movement, evasion, and persistence.

  2026-10-28 16:28 UTC
• Qilin Ransomware: Attacks, Victims and Latest Activity
  web:breachnews.com

  In July, Arctic Wolf linked Qilin ransomware attacks to exploitation of CVE-2026-0257, a PAN-OS VPN authentication bypass. Once inside , affiliates typically steal data before deploying ransomware , then use both encryption and the threat of publication as leverage.

  2026-10-28 16:28 UTC
• Qilin Ransomware: Attack Methods and 2026 Status
  web:cybelangel.com

  How Qilin ransomware operates, initial access, double extortion , recent victims including Die Linke, and what you need to detect and stop it.

  2026-10-28 16:28 UTC
• Qilin ransomware shows how RaaS scales intrusion and extortion
  web:nhimg.org

  TL;DR: Qilin's third-generation ransomware playbook combines affiliate -driven intrusion, lateral movement, double extortion , and political targeting, with attacks increasingly distributed across regions and sectors, according to Cybertrust Japan's analysis. The operating model reinforces that resilience depends on patching, access hardening, and recovery readiness, not just malware detection.

  2026-10-28 16:28 UTC
• Inside Qilin ransomware: ESXi attacks, affiliate networks and double ...
  web:www.acronis.com

  Affiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools. Qilin uses a flexible ransomware platform that allows affiliates to tailor attacks to the victim environment, including the encryption of local files, network shares and virtual machine infrastructure.

  2026-10-28 16:28 UTC
• Qilin LOTL Double Extortion - cohesity.com
  web:www.cohesity.com

  Cohesity REDLab analyzes the Qilin ransomware group's living-off-the-land, double-extortion tactics.

  2026-10-28 16:28 UTC
• Qilin Ransomware - A Double Extortion Campaign
  web:www.cyberflorida.org

  First observed in 2022, Qilin quickly became prominent after the decline of RansomHub in early 2025, absorbing many of its affiliates . Qilin operates under a Ransomware -as-a-Service (RaaS) model, in which a core group of cybercriminals develops, advertises, and leases their tools and infrastructure to other affiliate cybercriminals to conduct attacks . This group also uses a double extortion ...

  2026-10-28 16:28 UTC
• Qilin Ransomware Analysis | Detection & Remediation
  web:www.manageengine.com

  Explore Qilin Ransomware attack behavior, MITRE ATT&CK coverage, IOCs, and detection guidance, and see how Malware Protection Plus helps detect and remediate ransomware activity.

  2026-10-28 16:28 UTC
• Qilin Ransomware 2026: TTPs, Victims and Defense Guide
  web:www.moxfive.com

  The operation has expanded its targeting, grown its ransomware affiliate program, and built an extortion model that goes well beyond encryption. MOXFIVE tracking shows Qilin operators have claimed approximately 1,500 victims since launch, with more than 500 in 2026 alone, making it the most active ransomware operation in our dataset.

  2026-10-28 16:28 UTC
• Qilin Ransomware Attacks: How Enterprises Are Being Targeted
  web:www.proarch.com

  Qilin ransomware targets enterprises using RaaS and double extortion . Learn attack methods, risks, and how SOC teams detect and stop these intrusions.

  2026-10-28 16:28 UTC

Only Available for Registered Users. Sign in to view.