Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)

Key facts for Qilin Agenda ransomware

Detection coverage for Qilin Agenda ransomware

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5132 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Qilin Ransomware resmon.exe Masquerade and Qilin CLI Switch Execution

Detects the October 2026 Qilin (Agenda) modular variant executing as resmon.exe from anywhere other than C:\Windows\System32 (masquerading as Windows Resource Monitor with a forged Microsoft Code Signing PCA 2011 signature), or any process carrying Qilin-specific command-line switches (--spread-vcenter, --printer, --password with --cpu-threads, --safe-mode with --timeout). The legitimate resmon.exe only lives in System32, so a copy elsewhere is a high-fidelity signal of the Qilin payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1036.005, T1553.002
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\resmon.exe" NOT Image="C:\\Windows\\System32\\resmon.exe")
 OR CommandLine="*--spread-vcenter*" OR CommandLine="*--printer*"
 OR (CommandLine="*--password*" AND CommandLine="*--cpu-threads*")
 OR (CommandLine="*--safe-mode*" AND CommandLine="*--timeout*"))
| eval qilin_signal=if(like(lower(Image),"%resmon.exe") AND lower(Image)!="c:\\windows\\system32\\resmon.exe","resmon_masquerade","qilin_cli_switch")
| stats count min(_time) as first_seen max(_time) as last_seen values(qilin_signal) as signals values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "resmon.exe" and FolderPath !~ @"C:\Windows\System32\resmon.exe")
    or ProcessCommandLine has "--spread-vcenter"
    or ProcessCommandLine has "--printer"
    or (ProcessCommandLine has "--password" and ProcessCommandLine has "--cpu-threads")
    or (ProcessCommandLine has "--safe-mode" and ProcessCommandLine has "--timeout")
| extend QilinSignal = iff(FileName =~ "resmon.exe" and FolderPath !~ @"C:\Windows\System32\resmon.exe", "resmon_masquerade", "qilin_cli_switch")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, QilinSignal

Sigma

title: Qilin Ransomware resmon.exe Masquerade or Qilin CLI Switches
id: 7c1f0a52-3b8e-4d6a-9a47-5e2d1c8b9f30
status: experimental
description: Detects resmon.exe executing outside C:\Windows\System32 (Qilin October 2026 variant masquerading as Windows Resource Monitor) or Qilin-specific command-line switches such as --spread-vcenter, --printer and --password with --cpu-threads.
references:
    - https://www.seqrite.com/blog/the-evolution-of-qilin-agenda-a-comparative-reverse-engineering-analysis-of-qilin-agenda-ransomware-across-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1553.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_masquerade:
        Image|endswith: '\resmon.exe'
    filter_legit:
        Image: 'C:\Windows\System32\resmon.exe'
    selection_cli_any:
        CommandLine|contains:
            - '--spread-vcenter'
            - '--printer'
    selection_cli_combo:
        CommandLine|contains|all:
            - '--password'
            - '--cpu-threads'
    condition: (selection_masquerade and not filter_legit) or selection_cli_any or selection_cli_combo
falsepositives:
    - Portable or WinSxS copies of resmon.exe from legitimate servicing
    - Printing utilities that use a --printer switch
level: high

Known false positives:

• Legitimate WinSxS or servicing-stack copies of resmon.exe executing from a component store path
• Third-party print or admin tools that happen to use a --printer or --password switch

Tuning notes: Add a WinSxS exclusion (Image="C:\\Windows\\WinSxS\\*\\resmon.exe") after baselining. Pair with an Authenticode validation check (Sysmon EventCode 7 Signature/SignatureStatus or DeviceFileCertificateInfo) so resmon.exe with a non-Microsoft or invalid chain is escalated. Drop the bare --printer clause if it is noisy in print-heavy estates.

• 🔒 Qilin Volume Shadow Copy Purge via vssadmin, WMIC or PowerShell · unlock with TL Creds
• 🔒 Qilin AD Reconnaissance via DISM RSAT Install and Get-ADComputer · unlock with TL Creds
• 🔒 Qilin RAW/JetDirect TCP 9100 Printer Sweep (Ransom Note Delivery) · unlock with TL Creds
• 🔒 Qilin ESXi Mass VM Kill and SCP Payload Staging to /tmp · unlock with TL Creds
• 🔒 Qilin Self-Deletion via cmd.exe timeout and Del · unlock with TL Creds
• 🔒 Qilin Winlogon AutoAdminLogon Enabled for Unattended Safe Mode Login · unlock with TL Creds
• 🔒 Qilin Safe Mode Boot Forced via bcdedit safeboot (EDR Bypass) · unlock with TL Creds
• 🔒 Qilin PsExec Lateral Movement over [indicator] and C$ Shares · unlock with TL Creds

Indicators of compromise for Qilin Agenda ransomware

As of 2026-11-03, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5132.

Sample indicators (1 of 13)

• Domain: signspace[.]cloud

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How Qilin Agenda ransomware works

Qilin (originally launched as Agenda in July 2022) is a ransomware-as-a-service operation that practices double extortion: data theft followed by encryption, with victims pressured through a Tor leak site. HHS and other sources describe it as targeting healthcare and other industries worldwide. Seqrite's November 3, 2026 analysis compares a March 2026 sample (sample2.exe / wg.exe), a monolithic Rust binary that needed an operator to log in, supply parameters and run commands manually, with an October 2026 sample (resmon.exe), a modular Rust workspace of 22 internal crates across shared/ and spreading/ that spreads automatically across multiple user sessions.

Execution follows an eight-phase lifecycle: (1) campaign authentication by SHA-256 password validation via the --password switch; (2) privilege validation with TOKEN_QUERY and TokenElevation; (3) hypervisor profiling via CPUID leaf 1 (bit 31) and leaf 0x40000000 for VMware/Hyper-V; (4) crypto negotiation via CPUID leaf 1 bit 25 (AES-NI), falling back to ChaCha20; (5) ingestion of an embedded JSON configuration blob; (6) termination of 5 Windows services and 41 enterprise processes; (7) mass encryption with a randomized 10-character extension; (8) anti-forensics: volume shadow copy purge via vssadmin and WMIC, ransom notes and wallpaper modification. Files are encrypted with AES-256-CTR (ChaCha20 fallback) in intermittent 1 MB blocks, and keys are wrapped with an embedded RSA-4096 public key. The Windows, Program Files and System Volume Information directories and .exe, .dll and .sys files are excluded. The binary exposes 42 command-line switches, including --password, --cpu-threads, --timeout, --printer, --safe-mode and --spread-vcenter.

The October 2026 variant adds several capabilities. It forges a Microsoft Code Signing PCA 2011 signature overlay and masquerades as the Windows Resource Monitor binary (resmon.exe). It releases file locks through the Windows Restart Manager API (RmStartSession, RmRegisterResources, RmShutdown) so SQL Server, Exchange and VM disk files can be encrypted. It embeds 32-bit and 64-bit PsExec and spreads over ADMIN$ and C$ shares with harvested credentials, using DuplicateTokenEx to reach multiple user sessions. For AD reconnaissance it installs RSAT.ActiveDirectory.DirectoryServices through DISM, runs Get-ADComputer and validates hosts with ICMP pings. A 20.8 KB PowerShell suite authenticates to vCenter, disables HA and DRS, stages a Linux ELF ransomware payload over SSH/SCP to /tmp/ and uses esxcli to shut down VMs and encrypt .vmdk files. To neutralize EDR, it sets bcdedit safeboot minimal/network and configures Winlogon AutoAdminLogon so the host reboots unattended into Safe Mode, where third-party EDR drivers do not load. It also scans TCP 9100 (RAW/JetDirect) and sends cleartext ransom notes directly to office printers. After execution it self-deletes via 'cmd.exe /C timeout /T 10 & Del <payload_path>'.

Seqrite does not publish file hashes, IPs or domains for these samples, and no CVEs are cited. The forged signature fits a wider 2026 pattern: Microsoft's Digital Crimes Unit disclosed on May 19, 2026 that the Fox Tempest service abused Microsoft Artifact Signing to sell code-signing certificates to ransomware operators including Qilin. Seqrite does not attribute the October variant's signature to Fox Tempest, so that link is contextual only. Targeted sectors are healthcare, manufacturing, education and technology. Vendor detection names are Ransom.Qilin.S40227353 and Trojanransom.Generic.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1021.004 SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1569.002 Service Execution

defense-impairment

T1112 Modify Registry; T1553.002 Code Signing; T1688 Safe Mode Boot

Privilege Escalation

T1134.001 Token Impersonation/Theft

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Internal Defacement; T1529 System Shutdown/Reboot

Remediation for Qilin Agenda ransomware

Immediate actions

• Hunt for resmon.exe running outside C:\Windows\System32 or with an invalid or non-Microsoft Authenticode chain
• Alert on bcdedit.exe /set {current} safeboot minimal|network and on Winlogon AutoAdminLogon changes
• Alert on vssadmin and WMIC shadow copy deletion
• Alert on outbound TCP 9100 scanning from servers and workstations
• Isolate hosts showing PsExec service creation over ADMIN$ or C$ from non-admin systems

Workarounds

• Block Winlogon AutoAdminLogon configuration via policy where not required
• Restrict network printers from receiving RAW 9100 traffic from non-print-server hosts

Longer-term hardening

• Enforce EDR tamper protection, and use EDR that can load or alert in Safe Mode, or restrict the ability to change boot configuration
• Restrict PsExec and administrative share use with tiered administration and LAPS
• Isolate vCenter/ESXi management networks, disable ESXi SSH when unused, and require MFA for vCenter
• Maintain offline, immutable backups of VM and database data
• Validate code signatures against expected publishers rather than trusting a Microsoft-looking signer string

Affected and fixed versions

• Microsoft — Windows (endpoints and servers, including SQL Server and Exchange hosts)
  Vulnerable versions: Not version-specific
• VMware — vCenter / ESXi
  Vulnerable versions: Not version-specific; targeted by post-compromise PowerShell/esxcli tooling

Timeline of Qilin Agenda ransomware

• 2022-07-01 locked-ioc-12 RaaS operation initially launched as 'Agenda' (July 2022), later rebranded locked-ioc-12.
• 2024-06-21 HHS alerts the health sector to the locked-ioc-12 ransomware group, a RaaS targeting healthcare and other industries worldwide.
• 2025-05-01 locked-ioc-7 begins abusing Microsoft Artifact Signing to mass-produce fraudulent code-signing certificates later sold to ransomware operators.
• 2026-03-01 March 2026 baseline locked-ioc-12 variant (locked-ioc-6 / locked-ioc-9): monolithic, unsigned Rust binary requiring manual operator parameters.
• 2026-05-19 Microsoft DCU disrupts locked-ioc-7, seizing locked-ioc-4; Microsoft links the service's certificates to ransomware families including locked-ioc-12, INC, Akira and Rhysida.
• 2026-10-01 October 2026 modular variant (locked-ioc-8) observed: forged Microsoft Code Signing PCA 2011 signature, embedded locked-ioc-10, Restart Manager lock release, vCenter/ESXi tooling, Safe Mode EDR bypass and printer ransom notes.
• 2026-11-03 Seqrite publishes its comparative reverse-engineering analysis of the March and October 2026 locked-ioc-12 variants.

Sources cited for Qilin Agenda ransomware

• HHS HC3 Qilin Threat Profile hhs.gov · Advisory · 2024-06-21
• The Evolution of Qilin (Agenda): A Comparative Reverse Engineering Analysis of Qilin (Agenda) Ransomware Across 2026 seqrite.com · Research · 2026-11-03
• Microsoft Digital Crimes Unit disrupts Fox Tempest malware signing service Microsoft · Vendor report · 2026-05-19
• Qilin Ransomware: Attack Methods and 2026 Status (CybelAngel) cybelangel.com · Blog · 2026-01-01
• Microsoft shuts down malware signing service used by Rhysida and Qilin (Paubox) paubox.com · News · 2026-05-19
• HHS alerts health sector to cyberthreat from Qilin ransomware group (AHA) aha.org · News · 2024-06-21

More in ransomware

• Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak
• Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
• HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
• 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)