Skip to navigation

Threat reportRansomwareTL-2026-5787

Qilin Ransomware-as-a-Service Group: Leadership Attribution (Haise / Rjun / Alexbigboss44) and Most Active Affiliate Program

highACTIVE

Krebs on Security (2026-11-11) attributes the Qilin RaaS administrator (handle 'Haise', earlier 'Rjun' / 'Alexbigboss44') by linking identifiers across forums, breach data and vendor records; the attribution is the researchers' claim and the subject did not respond. NCC Group's Q3 2026 data ranks Qilin the most active ransomware group, with 365 claimed victims (13% of incidents). First disclosed .

Key facts

IdentifiersTL-2026-5787
Also known asAgenda, Qilin.B
SeverityHIGH
First disclosed
Affected productsMultiple Windows enterprise networks, VMware ESXi, Linux and Nutanix AHV hosts, VPN and remote-access services without MFA
AttributionQilin (medium confidence)
Nation-state nexusRussia
MalwareAgendaCrypt, AnyDesk, Cobalt Strike, MimiKatz, Qilin.B, SystemBC - S9001
ToolsBypassCredGuard, Cobalt Strike, Cyberduck, HRSword, Mimikatz, PSEXEC
MITRE ATT&CK techniquesT1003 OS Credential Dumping, T1021.001 Remote Desktop Protocol, T1021.002 SMB/Windows Admin Shares, T1048 Exfiltration Over Alternative Protocol, T1053.005 Scheduled Task, T1059.001 PowerShell, T1078 Valid Accounts, T1087.002 Domain Account, T1133 External Remote Services, T1219 Remote Access Tools, T1482 Domain Trust Discovery, T1489 Service Stop and 5 more in the attack flow
MotivationFINANCIAL
Target sectorsmanufacturing, professional-services, wholesale-trade, health, finance
Target regionsunited states of america, canada, united kingdom, france, germany
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5787 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Qilin Impact Staging — Shadow Copy Deletion, Service Stop, Log Clearing and Encryptor Artifacts

Detects pre-encryption and encryption-stage behaviour of Qilin (TL-2026-5787): vssadmin/wmic shadow copy deletion, bcdedit recovery disabling, wevtutil and Mimikatz event::clear log clearing, Veeam service stops (net stop and PowerShell Stop-Service), ESXi VM process kills, and encryptor artifacts (ElSDJGep.jpg wallpaper, %TEMP%\QLOG folder). Maps to T1490 Inhibit System Recovery, T1489 Service Stop, T1070.001 Clear Windows Event Logs, T1059.001 PowerShell and T1486 Data Encrypted for Impact.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1489, T1070.001, T1486, T1059.001
  • Data sources: sysmon (EventCode 1, 11), Microsoft Defender for Endpoint DeviceProcessEvents/DeviceFileEvents
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  ((EventCode=1 (CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*" OR CommandLine="*bcdedit*recoveryenabled*no*" OR CommandLine="*wevtutil*cl *" OR CommandLine="*event::clear*" OR CommandLine="*esxcli*vm*process*kill*" OR CommandLine="*net*stop*veeam*" OR CommandLine="*Stop-Service*Veeam*"))
  OR (EventCode=11 (TargetFilename="*\\ElSDJGep.jpg" OR TargetFilename="*\\QLOG\\*")))
| eval qilin_signal=case(EventCode=11,"Qilin encryptor artifact (ElSDJGep.jpg wallpaper or QLOG folder)",match(CommandLine,"(?i)wevtutil|event::clear"),"Event log clearing",match(CommandLine,"(?i)veeam|esxcli"),"Service or VM stop",true(),"Shadow copy or recovery inhibition")
| stats count min(_time) as first_seen max(_time) as last_seen values(qilin_signal) as signals values(CommandLine) as commands values(TargetFilename) as files by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
let cmds = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ("event::clear", "recoveryenabled no", "recoveryenabled No")
    or (ProcessCommandLine has "vssadmin" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows")
    or (ProcessCommandLine has "wmic" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (ProcessCommandLine has "wevtutil" and ProcessCommandLine has " cl ")
    or (ProcessCommandLine has "esxcli" and ProcessCommandLine has "process" and ProcessCommandLine has "kill")
    or (ProcessCommandLine has "veeam" and ProcessCommandLine has_any ("net stop", "Stop-Service", "sc stop"))
| project Timestamp, DeviceName, AccountName, Signal = "Recovery inhibition, service stop or log clearing", Detail = ProcessCommandLine;
let files = DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType == "FileCreated"
| where FileName =~ "ElSDJGep.jpg" or FolderPath has @"\QLOG"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = "Qilin encryptor artifact", Detail = FolderPath;
union cmds, files
| order by Timestamp desc

Sigma

title: Qilin Pre-Encryption Recovery Inhibition, Service Stop and Log Clearing
id: 5d9a7c30-2e4b-5f18-8c3d-1b0e6a4f7c03
status: experimental
description: Detects shadow copy deletion, boot recovery disabling, event log clearing, Veeam service stops (including PowerShell Stop-Service) and ESXi VM process kills that Qilin affiliates run immediately before deploying the encryptor (TL-2026-5787).
references:
    - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
    - https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.impact
    - attack.t1490
    - attack.t1489
    - attack.t1486
    - attack.defense-evasion
    - attack.t1070.001
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    selection_wmic:
        CommandLine|contains|all:
            - 'wmic'
            - 'shadowcopy'
            - 'delete'
    selection_bcd:
        CommandLine|contains|all:
            - 'bcdedit'
            - 'recoveryenabled'
            - 'no'
    selection_evtx:
        CommandLine|contains:
            - 'wevtutil cl '
            - 'event::clear'
    selection_svc:
        CommandLine|contains|all:
            - 'veeam'
            - 'stop'
    selection_esxi:
        CommandLine|contains|all:
            - 'esxcli'
            - 'process'
            - 'kill'
    condition: 1 of selection_*
falsepositives:
    - Backup or disk-maintenance scripts that remove shadow copies
    - Administrators clearing event logs or restarting Veeam services during troubleshooting
level: high

Known false positives:

  • Backup software that prunes shadow copies via vssadmin
  • Administrators clearing logs or restarting Veeam services during maintenance

Tuning notes: Exclude known backup service accounts and maintenance windows; treat vssadmin delete shadows from a non-SYSTEM interactive session as highest priority. Pair with ESXi syslog (esxcli / vim-cmd power.off) in a separate rule for hypervisor-side coverage.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Qilin Initial Access — Single-Factor VPN / RDP Sign-In from Multiple IPs or Countries · unlock with TL Creds
  • Qilin Exfiltration — Cyberduck / Backblaze B2 Transfers and [indicator] SMTP Staging · unlock with TL Creds
  • Qilin C2 — Cobalt Strike [indicator] Host Spoofing, HTTPS Beaconing and Community-Observed Sibling IPs · unlock with TL Creds
  • Qilin RMM Abuse — ScreenConnect on TCP 8880, RMM Agent Service Installs and Splashtop SRManager Payload Launch · unlock with TL Creds
  • Qilin Persistence — TVInstallRestore Scheduled Task, Run Key and TeamViewer_Host_Setup Masquerade · unlock with TL Creds
  • Qilin Lateral Movement and Discovery — PsExec Encryptor Spread, RDP Enablement, nltest/net Domain Reconnaissance · unlock with TL Creds
  • Qilin Credential Theft Staging — Mimikatz, SharpDecryptPwd, WDigest UseLogonCredential=1, LSASS Access · unlock with TL Creds
  • Qilin EDR Impairment — dark-kill / [indicator] BYOVD, HRSword and [indicator] Side-Loading · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5787.

Sample indicators (1 of 21)

  • Domain: ocsp[.]verisign[.]com

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Qilin (formerly Agenda; also tracked as Gold Feather and Water Galura) is a Russian-speaking ransomware-as-a-service operation active since roughly July-September 2022. Affiliates breach organizations, steal data and encrypt systems under a double-extortion model, publishing stolen files on a leak site if victims do not pay. Per Krebs, affiliates keep at least 80 percent of extortion payments, the program recruits English-speaking affiliates (unusual for Russia-based groups), and the leader has claimed on Telegram to have worked with Scattered Spider and RansomHub. The administrator applied to the RAMP forum in June 2022 and was approved; an affiliate-program advertisement was posted via Telegram in July 2024. The FBI seized RAMP in January 2026.

Attribution: Krebs on Security reports that IntelHawk (CTO Leo Bogod) and others (Intel 471, Flashpoint, SpyCloud, Constella Intelligence, Ke-la, 'Gang Exposed') link the handle 'Haise' to the earlier handles 'Rjun' and 'Alexbigboss44' used on Exploit, XSS and other Russian-language forums since about 2020, using breach records and stylometric/identifier correlation. This is an unproven researcher claim. Personal identifiers (phone, email, birth date, family, travel records) are intentionally omitted from this record, and the source itself states no CVEs, malware families or technical IOCs.

Activity level: NCC Group's Q3 2026 review counted 2,865 ransomware victim claims; Qilin led with 365 (13%), just ahead of The Gentlemen (359). NCC's August 2026 monthly review attributed 164 incidents to Qilin (15% share). Cisco Talos reported more than 40 leak-site postings per month in 2025 (except January), peaking near 100 in June 2025, with manufacturing (about 23%), professional and scientific services (about 18%) and wholesale trade (about 10%) the top sectors, and the US, Canada, UK, France and Germany the most affected countries.

Technical tradecraft (Cisco Talos, Oct 2025, and secondary reporting): initial access via leaked administrator credentials against VPNs lacking MFA (also reported: spear-phishing, ClickFix-style fake CAPTCHA pages on Cloudflare R2, and infostealer-sourced credentials); discovery with nltest/net; credential theft with Mimikatz, NirSoft utilities, BypassCredGuard and SharpDecryptPwd, plus a batch file enabling WDigest UseLogonCredential; exfiltration with Cyberduck to Backblaze and a VBScript sending results to an SMTP server; RMM tooling (AnyDesk, ScreenConnect, Atera, others); EDR tampering with dark-kill, HRSword, the BYOVD driver eskle.sys, and a msimg32.dll multi-stage loader reported to impair 300+ EDR drivers; Cobalt Strike with a Malleable C2 profile spoofing ocsp.verisign.com, and possibly SystemBC; encryptor deployment via PsExec, VMware ESXi manipulation, shadow copy deletion, and Linux encryptor execution on Windows. An MS-ISAC brief (April 2026) highlights the EDR-disabling tooling and notes that no joint CISA/FBI advisory for Qilin had been located in searches (one source says none as of August 2026).

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration to Cloud Storage

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Discovery

T1087.002 Domain Account; T1482 Domain Trust Discovery

Command and Control

T1219 Remote Access Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation

Patches

  • Keep VPN and perimeter devices patched; no specific CVE is named in the sources

Immediate actions

  • Enforce MFA on all VPN and remote-access services and reset credentials exposed in infostealer or dark-web leaks
  • Hunt for msimg32.dll side-loading, dark.sys/eskle.sys driver loads, HRSword, and WDigest UseLogonCredential set to 1
  • Audit and restrict RMM tools (AnyDesk, ScreenConnect, Atera, Splashtop, QuickAssist) to approved instances and alert on new installs
  • Alert on Cyberduck or other cloud-transfer clients and large uploads to Backblaze or other storage from servers

Workarounds

  • Disable WDigest credential caching, enable Credential Guard, and restrict RDP exposure

Longer-term hardening

  • Maintain offline/immutable backups and protect Veeam and other backup infrastructure credentials
  • Deploy EDR with tamper protection and block vulnerable drivers (HVCI, Microsoft vulnerable driver blocklist)
  • Restrict PsExec/SMB lateral movement, harden ESXi (lockdown mode, restrict SSH), and segment the network

Affected and fixed versions

  • Multiple — Windows enterprise networks, VMware ESXi, Linux and Nutanix AHV hosts, VPN and remote-access services without MFA
    Vulnerable versions: Environments with exposed single-factor VPN/RDP and unmanaged RMM tooling

Timeline

  • Per Krebs, the Qilin administrator applied to join the RAMP forum in June 2022 and was approved by its admin.
  • Qilin began operating (Krebs: September 2022; Talos/THN place emergence around July 2022 as Agenda).
  • The administrator's Telegram account advertised the Qilin affiliate program (July 2024).
  • Qilin leak-site postings peaked at about 100 cases in June 2025 per Cisco Talos.
  • Cisco Talos published its analysis of Qilin attack methods across multiple incident response cases.
  • The FBI seized the RAMP forum (January 2026), which Qilin used to advertise its program.
  • MS-ISAC executive threat brief warned of Qilin tooling that disables endpoint security products.
  • NCC Group Q3 2026 reporting ranked Qilin most active ransomware group: 365 claimed victims (13% of 2,865 total).
  • Krebs on Security published attribution of the Qilin administrator based on IntelHawk and other vendor/breach data.

Sources cited

More from Qilin

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats