Threat reportRansomwareTL-2026-4633
Qilin (Agenda) Ransomware: ESXi/vCenter Targeting, Affiliate Networks and Double Extortion
Qilin (Agenda) Ransomware (TL-2026-4633), also tracked as Qilin, is a high-severity ransomware operation, first published 2026-10-28. It is attributed to Qilin with medium confidence, affects VMware ESXi / vCenter Server, maps to 18 MITRE ATT&CK techniques (T1003.001, T1018, T1021.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1Qilin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4633
- Threat ID
- TL-2026-4633
- Also known as
- Qilin, Agenda
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Qilin
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, manufacturing, technology, finance
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Qilin (Agenda) Ransomware
Malware and tooling: AgendaCrypt, XData, securotrop, wikileaksv2, Tor - S0183
How Qilin (Agenda) Ransomware works
Qilin is a Russian-speaking ransomware-as-a-service operation active since 2022 that claimed 1,000+ victims in 2025 and 900+ in 2026. Its Rust-based Windows encryptor embeds a PowerShell routine that enumerates ESXi hosts via vCenter, changes ESXi credentials and configuration, enables SSH and uploads a payload to encrypt VMs, alongside data-theft double extortion.
Acronis Threat Research Unit (Darrel Virtusio, Eliad Kimhy; published 2026-10-28) analyzed Qilin (aka Agenda), a RaaS operation that emerged in 2022 and offers affiliates up to 85% of ransom proceeds. Qilin became the most active ransomware group by claimed victim count in 2025 (1,000+ claimed victims, up from 179 publicly reported attacks in 2024) and claimed 900+ victims in 2026. Healthcare accounts for roughly 13.3% of victims; the 2024 Synnovis attack on UK healthcare (about 900,000 records exposed, about $44M estimated impact, $50M ransom demand) is the best-known case. Targeting is concentrated on the United States, Canada and Europe; CIS countries are explicitly excluded.
Initial access comes through affiliates and includes targeted phishing, compromised VPN and RDP credentials, exploitation of vulnerable internet-facing applications and abuse of remote-management tools. Secondary reporting (HivePro) attributes exploitation of CVE-2025-31324 (SAP NetWeaver Visual Composer), CVE-2024-21762 and CVE-2024-55591 (Fortinet FortiOS) and CVE-2023-27532 (Veeam Backup & Replication) to Qilin affiliates. Post-compromise activity uses legitimate administrative tools for lateral movement and privilege escalation, disables security and recovery mechanisms, steals data, then deploys ransomware at scale. Secondary reporting also documents embedded PsExec, Mimikatz, AnyDesk/ScreenConnect/Splashtop/MeshCentral, WinSCP/Cyberduck/WinRAR for exfiltration, the BYOVD driver eskle.sys, a TeamViewer-masquerading scheduled task (TVInstallRestore), and execution of a Linux ELF encryptor via WSL to bypass PE-focused detection.
The analyzed Windows sample is a 4.69 MB Rust PE32 binary that requires a per-sample -password argument (validated against SHA-256 6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2, which is also the mutex name). Flags include no-escalate, impersonate, safe, no-vm, kill-cluster, fspread and spread-vcenter. A JSON configuration holds a hardcoded RSA-4096 public key, company_id (3Tqc380bbh, reused as the encrypted-file extension), optional domain credentials and the embedded ransom note. The sample enables SeDebugPrivilege, SeImpersonatePrivilege and SeIncreaseBasePriorityPrivilege, duplicates tokens for impersonation, detects hypervisors via CPUID, stops services and processes not on its blacklists, sets symbolic-link evaluation via fsutil (R2R:1, R2L:1), sets EnableLinkedConnections, enumerates network shares with net use, deletes shadow copies with vssadmin.exe delete shadows /all /quiet, and persists via a randomly named (six-letter) HKCU Run key.
When VM encryption is enabled, an embedded PowerShell script installs .NET Framework and the NuGet provider if missing, modifies PowerCLI configuration, disables ESXi cluster services, enumerates ESXi hosts via vCenter, changes ESXi passwords and configuration, enables SSH, and uploads and executes the payload on ESXi hosts. Files are encrypted with a per-file 32-byte key from BCryptGenRandom using AES-CTR (AES-NI present) or ChaCha20 (fallback); the key is encrypted with RSA-4096 and appended after a delimiter. Ransom notes named *README-RECOVER-<company-id>.txt are dropped in each folder and include blog links and chat-portal credentials. Logs are written to %AppData%\Local\Temp\QLOG and collected into QLOGS.zip.
Leak infrastructure consists of the Qilin blog (earliest listed entry 2025-03-21) and WikiLeaksV2 (wikileaks2.site), a clearnet site not directly operated by Qilin that republishes stolen data. The affiliate ecosystem includes Securotrop (operates within Qilin's affiliate network with its own leak site) and The Gentlemen, a separate RaaS that became a competitor after affiliate 'hastalamuerte' alleged an exit scam in August 2025 and leaked internal material. Linked groups cited by Acronis include Moonstone Sleet and Scattered Spider (alleged partnership). No CVE or CVSS is assigned to Qilin itself; severity is analyst-assigned and the primary source is a single vendor report supplemented by secondary reporting.
MITRE ATT&CK techniques used in TL-2026-4633
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Discovery
T1018 Remote System Discovery; T1057 Process Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services: SSH; T1570 Lateral Tool Transfer
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing
Defense Evasion
T1134 Access Token Manipulation; T1497.001 Virtualization/Sandbox Evasion: System Checks
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
defense-impairment
Affected products and versions in Qilin (Agenda) Ransomware
Remediation for Qilin (Agenda) Ransomware
Patches
- Patch internet-facing applications promptly, including CVE-2025-31324 (SAP NetWeaver), CVE-2024-21762 and CVE-2024-55591 (Fortinet FortiOS) and CVE-2023-27532 (Veeam) as cited in secondary reporting
Immediate actions
- Block and alert on the network and file IOCs listed for this threat
- Audit vCenter and ESXi for unexpected password changes, SSH enablement and new PowerCLI sessions
- Enforce phishing-resistant MFA on VPN, RDP and remote-management tools and review unusual logins
- Alert on vssadmin shadow-copy deletion, fsutil SymlinkEvaluation changes and mass service/process termination
Workarounds
- Disable unnecessary remote-access services and keep ESXi SSH disabled when not in use
- Restrict remote access to trusted networks and devices
Longer-term hardening
- Deploy EDR/XDR with ransomware behavioral detection (mass encryption, security tampering, credential theft, unauthorized drivers)
- Keep tested backups isolated from production with access controls that prevent modification or deletion by compromised systems
- Restrict and monitor PowerShell, PowerCLI and remote administration tools; alert on multi-host command execution
- Segment management networks for vCenter/ESXi and restrict SSH on ESXi hosts
Timeline of Qilin (Agenda) Ransomware
- Qilin (Agenda) ransomware-as-a-service operation emerges as a Russian-speaking RaaS with initially limited activity (active since at least July 2022).
- Qilin attack on Synnovis disrupts UK healthcare services; about 900,000 records exposed, about $44M estimated impact and a $50M ransom demand.
- Earliest victim entry listed on the Qilin blog leak site, per Acronis TRU.
- Top affiliate 'hastalamuerte' departs and later launches the competing RaaS The Gentlemen (secondary reporting).
- Affiliate 'hastalamuerte' accuses Qilin operators of an exit scam, claiming $48,000 withheld, and discloses affiliate infrastructure credentials, panel screenshots and internal chats.
- Qilin ends 2025 as the most active ransomware group by victim count, with 1,000+ claimed victims.
- FBI seizes the RAMP underground forum (January 2026); Qilin continues absorbing displaced affiliates (secondary reporting).
- Acronis TRU publishes analysis of Qilin's Windows encryptor, ESXi/vCenter PowerShell routine and affiliate ecosystem, citing 900+ claimed victims in 2026.
Sources cited for Qilin (Agenda) Ransomware
- Inside Qilin Ransomware: ESXi Attacks, Affiliate Networks and Double Extortion (Acronis TRU)
- Qilin Rising: Continued Global Dominance and Expanded Tradecraft (Hive Pro)
- Qilin (Agenda) Ransomware (ManageEngine)
- Top 5 Ransomware Groups in Q2 2026 (Brandefense)
- Agenda Ransomware Targets VMWare vCenter & ESXi Servers Globally (Hive Pro)
- Qilin Ransomware (Agenda): A Deep Dive (Check Point)
- Qilin threat actor profile (Bitsight)
- Agenda - Cloud Threat Landscape (Wiz)
Detection coverage for TL-2026-4633
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4633 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4633
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.