# Qilin Ransomware-as-a-Service Group: Leadership Attribution (Haise / Rjun / Alexbigboss44) and Most Active Affiliate Program

> Krebs on Security (2026-11-11) attributes the Qilin RaaS administrator (handle 'Haise', earlier 'Rjun' / 'Alexbigboss44') by linking identifiers across forums, breach data and vendor records; the attribution is the researchers' claim and the subject did not respond. NCC Group's Q3 2026 data ranks Qilin the most active ransomware group, with 365 claimed victims (13% of incidents).

- **Published:** 2026-11-11T18:37:08Z
- **Last reviewed:** 2026-11-11T18:37:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5787
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5787.png
- **ID:** TL-2026-5787
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (1 shown free below)

## Description

Qilin (formerly Agenda; also tracked as Gold Feather and Water Galura) is a Russian-speaking ransomware-as-a-service operation active since roughly July-September 2022. Affiliates breach organizations, steal data and encrypt systems under a double-extortion model, publishing stolen files on a leak site if victims do not pay. Per Krebs, affiliates keep at least 80 percent of extortion payments, the program recruits English-speaking affiliates (unusual for Russia-based groups), and the leader has claimed on Telegram to have worked with Scattered Spider and RansomHub. The administrator applied to the RAMP forum in June 2022 and was approved; an affiliate-program advertisement was posted via Telegram in July 2024. The FBI seized RAMP in January 2026.

Attribution: Krebs on Security reports that IntelHawk (CTO Leo Bogod) and others (Intel 471, Flashpoint, SpyCloud, Constella Intelligence, Ke-la, 'Gang Exposed') link the handle 'Haise' to the earlier handles 'Rjun' and 'Alexbigboss44' used on Exploit, XSS and other Russian-language forums since about 2020, using breach records and stylometric/identifier correlation. This is an unproven researcher claim. Personal identifiers (phone, email, birth date, family, travel records) are intentionally omitted from this record, and the source itself states no CVEs, malware families or technical IOCs.

Activity level: NCC Group's Q3 2026 review counted 2,865 ransomware victim claims; Qilin led with 365 (13%), just ahead of The Gentlemen (359). NCC's August 2026 monthly review attributed 164 incidents to Qilin (15% share). Cisco Talos reported more than 40 leak-site postings per month in 2025 (except January), peaking near 100 in June 2025, with manufacturing (about 23%), professional and scientific services (about 18%) and wholesale trade (about 10%) the top sectors, and the US, Canada, UK, France and Germany the most affected countries.

Technical tradecraft (Cisco Talos, Oct 2025, and secondary reporting): initial access via leaked administrator credentials against VPNs lacking MFA (also reported: spear-phishing, ClickFix-style fake CAPTCHA pages on Cloudflare R2, and infostealer-sourced credentials); discovery with nltest/net; credential theft with Mimikatz, NirSoft utilities, BypassCredGuard and SharpDecryptPwd, plus a batch file enabling WDigest UseLogonCredential; exfiltration with Cyberduck to Backblaze and a VBScript sending results to an SMTP server; RMM tooling (AnyDesk, ScreenConnect, Atera, others); EDR tampering with dark-kill, HRSword, the BYOVD driver eskle.sys, and a msimg32.dll multi-stage loader reported to impair 300+ EDR drivers; Cobalt Strike with a Malleable C2 profile spoofing ocsp.verisign.com, and possibly SystemBC; encryptor deployment via PsExec, VMware ESXi manipulation, shadow copy deletion, and Linux encryptor execution on Windows. An MS-ISAC brief (April 2026) highlights the EDR-disabling tooling and notes that no joint CISA/FBI advisory for Qilin had been located in searches (one source says none as of August 2026).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1003 OS Credential Dumping
- T1482 Domain Trust Discovery
- T1087.002 Domain Account
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1048 Exfiltration Over Alternative Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1059.001 PowerShell

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Qilin Impact Staging — Shadow Copy Deletion, Service Stop, Log Clearing and Encryptor Artifacts** (`TL-2026-5787-SPL-003`)

Detects pre-encryption and encryption-stage behaviour of Qilin (TL-2026-5787): vssadmin/wmic shadow copy deletion, bcdedit recovery disabling, wevtutil and Mimikatz event::clear log clearing, Veeam service stops (net stop and PowerShell Stop-Service), ESXi VM process kills, and encryptor artifacts (ElSDJGep.jpg wallpaper, %TEMP%\QLOG folder). Maps to T1490 Inhibit System Recovery, T1489 Service Stop, T1070.001 Clear Windows Event Logs, T1059.001 PowerShell and T1486 Data Encrypted for Impact.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1489, T1070.001, T1486, T1059.001
- **Data sources:** sysmon (EventCode 1, 11), Microsoft Defender for Endpoint DeviceProcessEvents/DeviceFileEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  ((EventCode=1 (CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*" OR CommandLine="*bcdedit*recoveryenabled*no*" OR CommandLine="*wevtutil*cl *" OR CommandLine="*event::clear*" OR CommandLine="*esxcli*vm*process*kill*" OR CommandLine="*net*stop*veeam*" OR CommandLine="*Stop-Service*Veeam*"))
  OR (EventCode=11 (TargetFilename="*\\ElSDJGep.jpg" OR TargetFilename="*\\QLOG\\*")))
| eval qilin_signal=case(EventCode=11,"Qilin encryptor artifact (ElSDJGep.jpg wallpaper or QLOG folder)",match(CommandLine,"(?i)wevtutil|event::clear"),"Event log clearing",match(CommandLine,"(?i)veeam|esxcli"),"Service or VM stop",true(),"Shadow copy or recovery inhibition")
| stats count min(_time) as first_seen max(_time) as last_seen values(qilin_signal) as signals values(CommandLine) as commands values(TargetFilename) as files by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
let cmds = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ("event::clear", "recoveryenabled no", "recoveryenabled No")
    or (ProcessCommandLine has "vssadmin" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows")
    or (ProcessCommandLine has "wmic" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (ProcessCommandLine has "wevtutil" and ProcessCommandLine has " cl ")
    or (ProcessCommandLine has "esxcli" and ProcessCommandLine has "process" and ProcessCommandLine has "kill")
    or (ProcessCommandLine has "veeam" and ProcessCommandLine has_any ("net stop", "Stop-Service", "sc stop"))
| project Timestamp, DeviceName, AccountName, Signal = "Recovery inhibition, service stop or log clearing", Detail = ProcessCommandLine;
let files = DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType == "FileCreated"
| where FileName =~ "ElSDJGep.jpg" or FolderPath has @"\QLOG"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = "Qilin encryptor artifact", Detail = FolderPath;
union cmds, files
| order by Timestamp desc
```

### Sigma

```yaml
title: Qilin Pre-Encryption Recovery Inhibition, Service Stop and Log Clearing
id: 5d9a7c30-2e4b-5f18-8c3d-1b0e6a4f7c03
status: experimental
description: Detects shadow copy deletion, boot recovery disabling, event log clearing, Veeam service stops (including PowerShell Stop-Service) and ESXi VM process kills that Qilin affiliates run immediately before deploying the encryptor (TL-2026-5787).
references:
    - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
    - https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.impact
    - attack.t1490
    - attack.t1489
    - attack.t1486
    - attack.defense-evasion
    - attack.t1070.001
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    selection_wmic:
        CommandLine|contains|all:
            - 'wmic'
            - 'shadowcopy'
            - 'delete'
    selection_bcd:
        CommandLine|contains|all:
            - 'bcdedit'
            - 'recoveryenabled'
            - 'no'
    selection_evtx:
        CommandLine|contains:
            - 'wevtutil cl '
            - 'event::clear'
    selection_svc:
        CommandLine|contains|all:
            - 'veeam'
            - 'stop'
    selection_esxi:
        CommandLine|contains|all:
            - 'esxcli'
            - 'process'
            - 'kill'
    condition: 1 of selection_*
falsepositives:
    - Backup or disk-maintenance scripts that remove shadow copies
    - Administrators clearing event logs or restarting Veeam services during troubleshooting
level: high

```

**Known false positives:**

- Backup software that prunes shadow copies via vssadmin
- Administrators clearing logs or restarting Veeam services during maintenance

**Tuning notes:** Exclude known backup service accounts and maintenance windows; treat vssadmin delete shadows from a non-SYSTEM interactive session as highest priority. Pair with ESXi syslog (esxcli / vim-cmd power.off) in a separate rule for hypervisor-side coverage.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Qilin Initial Access — Single-Factor VPN / RDP Sign-In from Multiple IPs or Countries (locked: unlock with TL Creds)
- Qilin Exfiltration — Cyberduck / Backblaze B2 Transfers and [indicator] SMTP Staging (locked: unlock with TL Creds)
- Qilin C2 — Cobalt Strike [indicator] Host Spoofing, HTTPS Beaconing and Community-Observed Sibling IPs (locked: unlock with TL Creds)
- Qilin RMM Abuse — ScreenConnect on TCP 8880, RMM Agent Service Installs and Splashtop SRManager Payload Launch (locked: unlock with TL Creds)
- Qilin Persistence — TVInstallRestore Scheduled Task, Run Key and TeamViewer_Host_Setup Masquerade (locked: unlock with TL Creds)
- Qilin Lateral Movement and Discovery — PsExec Encryptor Spread, RDP Enablement, nltest/net Domain Reconnaissance (locked: unlock with TL Creds)
- Qilin Credential Theft Staging — Mimikatz, SharpDecryptPwd, WDigest UseLogonCredential=1, LSASS Access (locked: unlock with TL Creds)
- Qilin EDR Impairment — dark-kill / [indicator] BYOVD, HRSword and [indicator] Side-Loading (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 21)

Defanged, TLP:CLEAR.

- Domain: `ocsp[.]verisign[.]com`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Who Runs the Ransomware Group Qilin? (Krebs on Security)](https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/)
- [Uncovering Qilin attack methods exposed through multiple cases (Cisco Talos)](https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/)
- [Cisco Talos Qilin IOCs (GitHub)](https://github.com/Cisco-Talos/IOCs/blob/main/2025/10/uncovering-qilin-attack-methods-exposed-through-multiple-cases.txt)
- [Qilin Ransomware Combines Linux Payload With BYOVD Exploit in Hybrid Attack (The Hacker News)](https://thehackernews.com/2025/10/qilin-ransomware-combines-linux-payload.html)
- [MS-ISAC Executive Threat Brief: Prominent Qilin Ransomware Leveraging Tool to Disable Endpoint Security Products](https://www.cisecurity.org/-/jssmedia/project/cisecurity/community-portal/emerging-threats/executive-threat-brief/04172026---ms-isac---executive-threat-brief---prominent-qilin-ransomware-leveraging-tool-to-disable-endpoint-security-products.pdf)
- [Global Ransomware Attacks Rise 23% in Q3 (Campus Technology, citing NCC Group)](https://campustechnology.com/articles/2026/11/02/global-ransomware-attacks-rise-23-in-q3.aspx)
- [Ransomware Attacks Rise 23 Percent (Redmondmag, citing NCC Group)](https://redmondmag.com/articles/2026/10/21/ransomware-attacks-rise-23-percent.aspx)
- [NCC Group Monthly Threat Pulse Review of June 2026](https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-june-2026/)
- [Qilin Ransomware Group Publishes Over 40 Cases Monthly (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/qilin-ransomware-40-cases-monthly)
- [CISA #StopRansomware: RansomHub Ransomware (AA24-242A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5787