# Qilin ransomware affiliate

> As of 2026-09-23, Qilin ransomware affiliate is a Unknown (Russia-nexus suspected)-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning vulnerability. Also known as Qilin, Agenda, Qilin affiliate. ATT&CK coverage spans 37 techniques across 15 tactics in 2 of 2 tracked threats. Most-observed techniques: T1003 (OS Credential Dumping), T1046 (Network Service Discovery), T1078 (Valid Accounts).

- **Nation:** Unknown (Russia-nexus suspected)
- **Tracked threats:** 2
- **Categories:** VULNERABILITY
- **Also known as:** Qilin, Agenda, Qilin affiliate
- **As of:** 2026-09-23

## ATT&CK techniques observed

37 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (5), Discovery (4), Impact (4), Persistence (4), Credential Access (3), Execution (3).

- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 2 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1087](https://intel.threadlinqs.com/technique/T1087) Account Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1572](https://intel.threadlinqs.com/technique/T1572) Protocol Tunneling — Command and Control — observed in 2 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1018](https://intel.threadlinqs.com/technique/T1018) Remote System Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 1 of 2 tracked threats
- [T1021.006](https://intel.threadlinqs.com/technique/T1021.006) Windows Remote Management — Lateral Movement — observed in 1 of 2 tracked threats
- [T1037.004](https://intel.threadlinqs.com/technique/T1037.004) RC Scripts — Persistence — observed in 1 of 2 tracked threats
- [T1039](https://intel.threadlinqs.com/technique/T1039) Data from Network Shared Drive — Collection — observed in 1 of 2 tracked threats
- [T1040](https://intel.threadlinqs.com/technique/T1040) Network Sniffing — Discovery — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1059.004](https://intel.threadlinqs.com/technique/T1059.004) Unix Shell — Execution — observed in 1 of 2 tracked threats

## Tracked threats

- [Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)](https://intel.threadlinqs.com/threat/TL-2026-2630) — CRITICAL
- [Check Point Remote Access & Mobile Access VPN IKEv1 Authentication Bypass (CVE-2026-50751) Exploited by Qilin Ransomware Affiliate](https://intel.threadlinqs.com/threat/TL-2026-0718) — CRITICAL

## Related CVEs

17 CVEs referenced by tracked Qilin ransomware affiliate activity.

- [CVE-2026-91843](https://intel.threadlinqs.com/cve/CVE-2026-91843)
- [CVE-2026-85103](https://intel.threadlinqs.com/cve/CVE-2026-85103)
- [CVE-2026-85102](https://intel.threadlinqs.com/cve/CVE-2026-85102)
- [CVE-2026-83549](https://intel.threadlinqs.com/cve/CVE-2026-83549)
- [CVE-2026-83548](https://intel.threadlinqs.com/cve/CVE-2026-83548)
- [CVE-2026-76460](https://intel.threadlinqs.com/cve/CVE-2026-76460)
- [CVE-2026-73456](https://intel.threadlinqs.com/cve/CVE-2026-73456)
- [CVE-2026-73453](https://intel.threadlinqs.com/cve/CVE-2026-73453)
- [CVE-2026-6485](https://intel.threadlinqs.com/cve/CVE-2026-6485)
- [CVE-2026-50752](https://intel.threadlinqs.com/cve/CVE-2026-50752)
- [CVE-2026-50751](https://intel.threadlinqs.com/cve/CVE-2026-50751)
- [CVE-2026-33197](https://intel.threadlinqs.com/cve/CVE-2026-33197)
- [CVE-2026-31431](https://intel.threadlinqs.com/cve/CVE-2026-31431)
- [CVE-2026-20316](https://intel.threadlinqs.com/cve/CVE-2026-20316)
- [CVE-2026-20293](https://intel.threadlinqs.com/cve/CVE-2026-20293)
- [CVE-2026-20212](https://intel.threadlinqs.com/cve/CVE-2026-20212)
- [CVE-2026-20079](https://intel.threadlinqs.com/cve/CVE-2026-20079)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Qilin%20ransomware%20affiliate