# Qilin (Agenda) Ransomware: ESXi/vCenter Targeting, Affiliate Networks and Double Extortion

> Qilin is a Russian-speaking ransomware-as-a-service operation active since 2022 that claimed 1,000+ victims in 2025 and 900+ in 2026. Its Rust-based Windows encryptor embeds a PowerShell routine that enumerates ESXi hosts via vCenter, changes ESXi credentials and configuration, enables SSH and uploads a payload to encrypt VMs, alongside data-theft double extortion.

- **Published:** 2026-10-28T10:33:14Z
- **Last reviewed:** 2026-10-28T10:33:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4633
- **ID:** TL-2026-4633
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Acronis Threat Research Unit (Darrel Virtusio, Eliad Kimhy; published 2026-10-28) analyzed Qilin (aka Agenda), a RaaS operation that emerged in 2022 and offers affiliates up to 85% of ransom proceeds. Qilin became the most active ransomware group by claimed victim count in 2025 (1,000+ claimed victims, up from 179 publicly reported attacks in 2024) and claimed 900+ victims in 2026. Healthcare accounts for roughly 13.3% of victims; the 2024 Synnovis attack on UK healthcare (about 900,000 records exposed, about $44M estimated impact, $50M ransom demand) is the best-known case. Targeting is concentrated on the United States, Canada and Europe; CIS countries are explicitly excluded.

Initial access comes through affiliates and includes targeted phishing, compromised VPN and RDP credentials, exploitation of vulnerable internet-facing applications and abuse of remote-management tools. Secondary reporting (HivePro) attributes exploitation of CVE-2025-31324 (SAP NetWeaver Visual Composer), CVE-2024-21762 and CVE-2024-55591 (Fortinet FortiOS) and CVE-2023-27532 (Veeam Backup & Replication) to Qilin affiliates. Post-compromise activity uses legitimate administrative tools for lateral movement and privilege escalation, disables security and recovery mechanisms, steals data, then deploys ransomware at scale. Secondary reporting also documents embedded PsExec, Mimikatz, AnyDesk/ScreenConnect/Splashtop/MeshCentral, WinSCP/Cyberduck/WinRAR for exfiltration, the BYOVD driver eskle.sys, a TeamViewer-masquerading scheduled task (TVInstallRestore), and execution of a Linux ELF encryptor via WSL to bypass PE-focused detection.

The analyzed Windows sample is a 4.69 MB Rust PE32 binary that requires a per-sample -password argument (validated against SHA-256 6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2, which is also the mutex name). Flags include no-escalate, impersonate, safe, no-vm, kill-cluster, fspread and spread-vcenter. A JSON configuration holds a hardcoded RSA-4096 public key, company_id (3Tqc380bbh, reused as the encrypted-file extension), optional domain credentials and the embedded ransom note. The sample enables SeDebugPrivilege, SeImpersonatePrivilege and SeIncreaseBasePriorityPrivilege, duplicates tokens for impersonation, detects hypervisors via CPUID, stops services and processes not on its blacklists, sets symbolic-link evaluation via fsutil (R2R:1, R2L:1), sets EnableLinkedConnections, enumerates network shares with net use, deletes shadow copies with vssadmin.exe delete shadows /all /quiet, and persists via a randomly named (six-letter) HKCU Run key.

When VM encryption is enabled, an embedded PowerShell script installs .NET Framework and the NuGet provider if missing, modifies PowerCLI configuration, disables ESXi cluster services, enumerates ESXi hosts via vCenter, changes ESXi passwords and configuration, enables SSH, and uploads and executes the payload on ESXi hosts. Files are encrypted with a per-file 32-byte key from BCryptGenRandom using AES-CTR (AES-NI present) or ChaCha20 (fallback); the key is encrypted with RSA-4096 and appended after a delimiter. Ransom notes named *README-RECOVER-<company-id>.txt are dropped in each folder and include blog links and chat-portal credentials. Logs are written to %AppData%\Local\Temp\QLOG and collected into QLOGS.zip.

Leak infrastructure consists of the Qilin blog (earliest listed entry 2025-03-21) and WikiLeaksV2 (wikileaks2.site), a clearnet site not directly operated by Qilin that republishes stolen data. The affiliate ecosystem includes Securotrop (operates within Qilin's affiliate network with its own leak site) and The Gentlemen, a separate RaaS that became a competitor after affiliate 'hastalamuerte' alleged an exit scam in August 2025 and leaked internal material. Linked groups cited by Acronis include Moonstone Sleet and Scattered Spider (alleged partnership). No CVE or CVSS is assigned to Qilin itself; severity is analyst-assigned and the primary source is a single vendor report supplemented by secondary reporting.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1003.001 OS Credential Dumping: LSASS Memory
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.004 Remote Services: SSH
- T1570 Lateral Tool Transfer
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Inside Qilin Ransomware: ESXi Attacks, Affiliate Networks and Double Extortion (Acronis TRU)](https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/)
- [Qilin Rising: Continued Global Dominance and Expanded Tradecraft (Hive Pro)](https://www.hivepro.com/threat-advisory/qilin-rising-continued-global-dominance-and-expanded-tradecraft)
- [Qilin (Agenda) Ransomware (ManageEngine)](https://www.manageengine.com/malware-protection/adversaries/qilin-ransomware.html)
- [Top 5 Ransomware Groups in Q2 2026 (Brandefense)](https://brandefense.io/blog/top-5-ransomware-groups-q2-2026/)
- [Agenda Ransomware Targets VMWare vCenter & ESXi Servers Globally (Hive Pro)](https://hivepro.com/?p=17188)
- [Qilin Ransomware (Agenda): A Deep Dive (Check Point)](https://www.checkpoint.com/de/cyber-hub/threat-prevention/ransomware/qilin-ransomware/)
- [Qilin threat actor profile (Bitsight)](https://www.bitsight.com/underground/threat-actors/qilin)
- [Agenda - Cloud Threat Landscape (Wiz)](https://threats.wiz.io/all-actors/agenda)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4633