The Anatomy of a Qilin Attack: Technical Indicators and C2 Infrastructure

Background

Qilin first appeared as Agenda in mid-2022, then rebranded and re-engineered. The payload moved from Go to Rust, which brought better performance, harder analysis and cross-platform builds targeting Windows, Linux and VMware ESXi. It operates as ransomware-as-a-service: a core team maintains the encryptor, negotiation and leak infrastructure while affiliates run intrusions and keep 80 to 85 percent of each ransom. Extortion is double: data is exfiltrated before encryption, and a Tor plus clear-web leak site is used to name and shame non-payers.

The scale in 2025 is why this matters now. Qilin overtook RansomHub as the most active ransomware targeting US state, local, tribal and territorial government in Q2 2025 (rising from roughly 9 percent to 24 percent of reported incidents) and went on to publish more victims than any other group for the year, sustaining 40-plus new listings per month. Small and mid-sized businesses, healthcare and government have all featured heavily.

One clarification before the technical section. This write-up profiles the Qilin group, whose activity is well documented. The specific PE that triggered this analysis is a separate, unattributed sample: automated triage rated it critical on behaviour, but it produced no confident family match. We present it as a suspected ransomware-class binary consistent with the current threat picture, and we are explicit about what is confirmed versus inferred.

What we observed

What the analysed sample shows, and what it does not:

• High behavioural risk, no family attribution: the 2.3 MB PE scored 93/100 MALICIOUS, yet the engine reported no confident family match. Nothing in this analysis proves it is Qilin specifically, so we do not claim it is.
• A revealing detection gap: zero YARA/signature rules fired and the ML ensemble scored only 45 percent, while heuristics and behaviour drove the verdict to 93/100. An unsigned, likely packed PE that evades signatures and splits ML is exactly the profile modern Rust ransomware presents, and a reminder to weight behaviour over signatures.
• Privilege-escalation evidence: the one high-confidence technique was Access Token Manipulation (T1134), a common route to run the encryptor with elevated rights, consistent with ransomware tradecraft.
• Discovery-led behaviour: the top mapped tactic was Discovery, matching the recon a ransomware affiliate performs to map hosts and shares before deploying the payload.
• Heuristic ransomware and C2 flags: triage noted potential encryption / shadow-copy tampering and possible command-and-control. These are heuristic indicators on this sample (not confirmed capabilities) and align with, but do not by themselves prove, ransomware behaviour.

Qilin double-extortion playbook

Qilin affiliates steal data before they encrypt, so the leak-site threat survives even a clean restore from backup. Detection has to catch the discovery and exfiltration stages, not just the encryptor.

Attribution

Qilin is a financially motivated, Russian-speaking-adjacent RaaS operation (evolved from Agenda); this is not a nation-state actor. Confidence in the group profile and the 2025 activity surge is high and drawn from multiple public trackers. Confidence that the analysed PE is Qilin specifically is low: the engine found no family match, so it is presented as a suspected, unattributed ransomware-class sample. The ATT&CK entries below distinguish what was evidenced on the sample from techniques documented for Qilin.

Confidence: 65%.

Over 1,000 published victims and 40-plus new names a month. Qilin did not just surge in 2025, it became the most active ransomware operation on the planet.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Qilin-style ransomware behaviour hunt (behaviour-first, not signature-dependent)
# 1) Shadow-copy / recovery tampering (pre-encryption)
index=edr (process_name IN ("vssadmin.exe","wmic.exe","wbadmin.exe","bcdedit.exe")) (command_line="*delete*shadows*" OR command_line="*resize*shadowstorage*" OR command_line="*recoveryenabled no*" OR command_line="*delete catalog*")
# 2) Token manipulation / privilege escalation to run the encryptor
index=edr (technique="T1134" OR event="AdjustTokenPrivileges" AND command_line="*SeDebugPrivilege*")
# 3) Rapid mass file modification + ransom-note drops
index=edr file_event=modify (file_name="*.encrypted" OR file_name="*README*RECOVER*" OR file_name="*how*to*decrypt*") | stats count by host, process | where count > 200
# 4) ESXi / Linux targeting (Rust builds)
index=edr OR index=esxi (command_line="*esxcli vm process kill*" OR command_line="*/vmfs/volumes/*" OR process_name="*encrypt*")
# 5) Known hashes for THIS sample (not proof of Qilin; correlate before attributing)
index=edr (sha256="ba131068e6ef6866e288353ef0ff6dee5c0dc9503714f8a9dfd0fea3a86fddaa" OR md5="2674ad25fabe97a9eb10dcdbd32e4c9d")
#
# Note: this PE fired 0 signatures and scored 45% ML. Do not rely on signatures alone -- hunt behaviour.

Recommendations

• Backups first: keep offline, immutable, tested backups and rehearse restore, because double extortion means recovery alone does not remove the leak-site threat.
• Cut the affiliate’s easy paths: enforce phishing-resistant MFA on VPN/RDP/webmail, disable exposed RDP, patch external-facing services fast, and monitor for valid-account abuse.
• Detect the pre-encryption stages: alert on shadow-copy deletion, mass file rename, token-manipulation and unusual internal discovery, and enable EDR tamper protection so the payload cannot disable defences.
• Watch egress for exfiltration: flag large or unusual outbound transfers to file-sharing / cloud services, since Qilin steals data before it encrypts.
• Do not over-attribute this sample: treat the hashes as a suspected ransomware-class PE, correlate with your own telemetry before calling it Qilin, and weight behavioural detections over the 0 signature / 45 percent ML result.
• Protect virtualisation: harden and monitor VMware ESXi and Linux hosts, since the Rust builds explicitly target them and an ESXi hit can encrypt many VMs at once.