# Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)

> Seqrite's comparative reverse engineering contrasts a March 2026 monolithic, unsigned Qilin (Agenda) Rust binary with an October 2026 modular variant (resmon.exe) carrying a forged Microsoft Code Signing PCA 2011 signature. The newer variant adds Restart Manager file-lock release, embedded PsExec spreading, AD reconnaissance, VMware vCenter/ESXi attack scripts, Safe Mode EDR bypass and network printer ransom-note delivery.

- **Published:** 2026-11-03T08:04:38Z
- **Last reviewed:** 2026-11-03T08:04:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5132
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5132.png
- **ID:** TL-2026-5132
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin RaaS
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

Qilin (originally launched as Agenda in July 2022) is a ransomware-as-a-service operation that practices double extortion: data theft followed by encryption, with victims pressured through a Tor leak site. HHS and other sources describe it as targeting healthcare and other industries worldwide. Seqrite's November 3, 2026 analysis compares a March 2026 sample (sample2.exe / wg.exe), a monolithic Rust binary that needed an operator to log in, supply parameters and run commands manually, with an October 2026 sample (resmon.exe), a modular Rust workspace of 22 internal crates across shared/ and spreading/ that spreads automatically across multiple user sessions.

Execution follows an eight-phase lifecycle: (1) campaign authentication by SHA-256 password validation via the --password switch; (2) privilege validation with TOKEN_QUERY and TokenElevation; (3) hypervisor profiling via CPUID leaf 1 (bit 31) and leaf 0x40000000 for VMware/Hyper-V; (4) crypto negotiation via CPUID leaf 1 bit 25 (AES-NI), falling back to ChaCha20; (5) ingestion of an embedded JSON configuration blob; (6) termination of 5 Windows services and 41 enterprise processes; (7) mass encryption with a randomized 10-character extension; (8) anti-forensics: volume shadow copy purge via vssadmin and WMIC, ransom notes and wallpaper modification. Files are encrypted with AES-256-CTR (ChaCha20 fallback) in intermittent 1 MB blocks, and keys are wrapped with an embedded RSA-4096 public key. The Windows, Program Files and System Volume Information directories and .exe, .dll and .sys files are excluded. The binary exposes 42 command-line switches, including --password, --cpu-threads, --timeout, --printer, --safe-mode and --spread-vcenter.

The October 2026 variant adds several capabilities. It forges a Microsoft Code Signing PCA 2011 signature overlay and masquerades as the Windows Resource Monitor binary (resmon.exe). It releases file locks through the Windows Restart Manager API (RmStartSession, RmRegisterResources, RmShutdown) so SQL Server, Exchange and VM disk files can be encrypted. It embeds 32-bit and 64-bit PsExec and spreads over ADMIN$ and C$ shares with harvested credentials, using DuplicateTokenEx to reach multiple user sessions. For AD reconnaissance it installs RSAT.ActiveDirectory.DirectoryServices through DISM, runs Get-ADComputer and validates hosts with ICMP pings. A 20.8 KB PowerShell suite authenticates to vCenter, disables HA and DRS, stages a Linux ELF ransomware payload over SSH/SCP to /tmp/ and uses esxcli to shut down VMs and encrypt .vmdk files. To neutralize EDR, it sets bcdedit safeboot minimal/network and configures Winlogon AutoAdminLogon so the host reboots unattended into Safe Mode, where third-party EDR drivers do not load. It also scans TCP 9100 (RAW/JetDirect) and sends cleartext ransom notes directly to office printers. After execution it self-deletes via 'cmd.exe /C timeout /T 10 & Del <payload_path>'.

Seqrite does not publish file hashes, IPs or domains for these samples, and no CVEs are cited. The forged signature fits a wider 2026 pattern: Microsoft's Digital Crimes Unit disclosed on May 19, 2026 that the Fox Tempest service abused Microsoft Artifact Signing to sell code-signing certificates to ransomware operators including Qilin. Seqrite does not attribute the October variant's signature to Fox Tempest, so that link is contextual only. Targeted sectors are healthcare, manufacturing, education and technology. Vendor detection names are Ransom.Qilin.S40227353 and Trojanransom.Generic.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1134.001 Token Impersonation/Theft
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1688 Safe Mode Boot
- T1112 Modify Registry
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1570 Lateral Tool Transfer
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1491.001 Internal Defacement

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Qilin Ransomware resmon.exe Masquerade and Qilin CLI Switch Execution** (`TL-2026-5132-SPL-001`)

Detects the October 2026 Qilin (Agenda) modular variant executing as resmon.exe from anywhere other than C:\Windows\System32 (masquerading as Windows Resource Monitor with a forged Microsoft Code Signing PCA 2011 signature), or any process carrying Qilin-specific command-line switches (--spread-vcenter, --printer, --password with --cpu-threads, --safe-mode with --timeout). The legitimate resmon.exe only lives in System32, so a copy elsewhere is a high-fidelity signal of the Qilin payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1036.005, T1553.002
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\resmon.exe" NOT Image="C:\\Windows\\System32\\resmon.exe")
 OR CommandLine="*--spread-vcenter*" OR CommandLine="*--printer*"
 OR (CommandLine="*--password*" AND CommandLine="*--cpu-threads*")
 OR (CommandLine="*--safe-mode*" AND CommandLine="*--timeout*"))
| eval qilin_signal=if(like(lower(Image),"%resmon.exe") AND lower(Image)!="c:\\windows\\system32\\resmon.exe","resmon_masquerade","qilin_cli_switch")
| stats count min(_time) as first_seen max(_time) as last_seen values(qilin_signal) as signals values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "resmon.exe" and FolderPath !~ @"C:\Windows\System32\resmon.exe")
    or ProcessCommandLine has "--spread-vcenter"
    or ProcessCommandLine has "--printer"
    or (ProcessCommandLine has "--password" and ProcessCommandLine has "--cpu-threads")
    or (ProcessCommandLine has "--safe-mode" and ProcessCommandLine has "--timeout")
| extend QilinSignal = iff(FileName =~ "resmon.exe" and FolderPath !~ @"C:\Windows\System32\resmon.exe", "resmon_masquerade", "qilin_cli_switch")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, QilinSignal
```

### Sigma

```yaml
title: Qilin Ransomware resmon.exe Masquerade or Qilin CLI Switches
id: 7c1f0a52-3b8e-4d6a-9a47-5e2d1c8b9f30
status: experimental
description: Detects resmon.exe executing outside C:\Windows\System32 (Qilin October 2026 variant masquerading as Windows Resource Monitor) or Qilin-specific command-line switches such as --spread-vcenter, --printer and --password with --cpu-threads.
references:
    - https://www.seqrite.com/blog/the-evolution-of-qilin-agenda-a-comparative-reverse-engineering-analysis-of-qilin-agenda-ransomware-across-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1553.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_masquerade:
        Image|endswith: '\resmon.exe'
    filter_legit:
        Image: 'C:\Windows\System32\resmon.exe'
    selection_cli_any:
        CommandLine|contains:
            - '--spread-vcenter'
            - '--printer'
    selection_cli_combo:
        CommandLine|contains|all:
            - '--password'
            - '--cpu-threads'
    condition: (selection_masquerade and not filter_legit) or selection_cli_any or selection_cli_combo
falsepositives:
    - Portable or WinSxS copies of resmon.exe from legitimate servicing
    - Printing utilities that use a --printer switch
level: high
```

**Known false positives:**

- Legitimate WinSxS or servicing-stack copies of resmon.exe executing from a component store path
- Third-party print or admin tools that happen to use a --printer or --password switch

**Tuning notes:** Add a WinSxS exclusion (Image="C:\\Windows\\WinSxS\\*\\resmon.exe") after baselining. Pair with an Authenticode validation check (Sysmon EventCode 7 Signature/SignatureStatus or DeviceFileCertificateInfo) so resmon.exe with a non-Microsoft or invalid chain is escalated. Drop the bare --printer clause if it is noisy in print-heavy estates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Qilin Volume Shadow Copy Purge via vssadmin, WMIC or PowerShell (locked: unlock with TL Creds)
- Qilin AD Reconnaissance via DISM RSAT Install and Get-ADComputer (locked: unlock with TL Creds)
- Qilin RAW/JetDirect TCP 9100 Printer Sweep (Ransom Note Delivery) (locked: unlock with TL Creds)
- Qilin ESXi Mass VM Kill and SCP Payload Staging to /tmp (locked: unlock with TL Creds)
- Qilin Self-Deletion via cmd.exe timeout and Del (locked: unlock with TL Creds)
- Qilin Winlogon AutoAdminLogon Enabled for Unattended Safe Mode Login (locked: unlock with TL Creds)
- Qilin Safe Mode Boot Forced via bcdedit safeboot (EDR Bypass) (locked: unlock with TL Creds)
- Qilin PsExec Lateral Movement over [indicator] and C$ Shares (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- Domain: `signspace[.]cloud`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Evolution of Qilin (Agenda): A Comparative Reverse Engineering Analysis of Qilin (Agenda) Ransomware Across 2026](https://www.seqrite.com/blog/the-evolution-of-qilin-agenda-a-comparative-reverse-engineering-analysis-of-qilin-agenda-ransomware-across-2026/)
- [Microsoft Digital Crimes Unit disrupts Fox Tempest malware signing service](https://blogs.microsoft.com/on-the-issues/2026/05/19/microsoft-digital-crimes-unit-disrupts-fox-tempest-malware-signing-service/)
- [Microsoft shuts down malware signing service used by Rhysida and Qilin (Paubox)](https://www.paubox.com/blog/microsoft-shuts-down-malware-signing-service-used-by-rhysida-and-qilin)
- [HHS HC3 Qilin Threat Profile](https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf)
- [HHS alerts health sector to cyberthreat from Qilin ransomware group (AHA)](https://www.aha.org/news/headline/2024-06-21-hhs-alerts-health-sector-cyberthreat-qilin-ransomware-group)
- [Qilin Ransomware: Attack Methods and 2026 Status (CybelAngel)](https://cybelangel.com/blog/qilin-ransomware-tactics-attack/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5132