Acronis Analyzes Qilin Ransomware’s Windows and ESXi Capabilities
Summary
Acronis analyzes Qilin/Agenda’s affiliate operation and ransomware sample, detailing Windows and ESXi targeting, access methods, configurable encryption, double extortion and defensive recommendations.
Key points
- Acronis reports that Qilin has operated since 2022, with 179 publicly reported attacks in 2024 and more than 1,000 claimed victims in 2025.
- Affiliates commonly gain access through phishing, compromised VPN or RDP credentials, vulnerable internet-facing applications and remote-management tools.
- The analyzed sample can target local files, network resources and virtual machines; a PowerShell script can change ESXi host configurations, enable SSH and run payloads on hosts.
- The sample can establish persistence, stop selected processes and services, and delete Volume Shadow Copies before encryption.
- It uses AES-CTR when AES-NI is available and ChaCha20 otherwise; it generates per-file keys and encrypts them with RSA-4096.
- The report describes Qilin’s double-extortion model and says Securotrop remains in its affiliate network while operating a separate leak site.
- Recommended defenses include EDR, phishing-resistant MFA for remote access, prompt patching, monitoring administrative tools and maintaining isolated, tested backups.
Article Details
- Attack Vectors
- Qilin affiliates commonly gain initial access through targeted phishing, compromised VPN or RDP credentials, exploitation of vulnerable internet-facing applications, and abuse of remote-management tools.
- The ransomware can encrypt local files, mounted and network resources, and virtual-machine infrastructure, including ESXi hosts; a PowerShell script can upload and execute payloads on ESXi hosts.
- Qilin uses double extortion: it encrypts victim data and threatens to publish stolen information if the ransom is not paid.
- Defensive Notes
- Use phishing-resistant MFA for VPN, RDP, and other remote access; restrict access to trusted networks or devices and monitor unusual logins.
- Keep operating systems, applications, network devices, security products, and third-party software patched, especially internet-facing applications.
- Monitor and restrict PowerShell, remote-administration tools, and unusual administrative activity that disables security controls, changes system settings, or runs commands across multiple hosts.
- Maintain regular, tested backups protected from modification or deletion by compromised systems; isolate critical backups where possible.
- Use endpoint security capable of detecting mass file encryption, suspicious process or service termination, security-tool tampering, credential theft, and unauthorized driver loading.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756 | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | 24a24c5fe9a5dc242b2908d020f890ed5b3afe8146fade4e3ab8a07d19007b6d | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | 43672ef1384888922c13838f695da58f8cb9b8ad47ce896b3b7151e7edd18afb | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | 4f8efbfe1f94dc7c6d5547c836e56ed56b1b3c33d324bd8619b8108c572b5ca6 | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | 516927b55038c1702bc8a6a0262a39d5fe45f4b07527fdc42415533a9665264a | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | 54f36b39e5bcee15acc530d70c173f26a1e1d7a62e866181d8a68309b4660928 | SHA-256 hash listed for a Windows Securotrop ransomware IOC. |
| SHA256 | 61820172ff5440c9e4f48695cc3551638306d06214cf72df41740dd08d734104 | SHA-256 hash listed for a Windows Securotrop ransomware IOC. |
| SHA256 | 62fd30a7841f36b389af9cf4b3230c666bf620d9f57eb3bf73a06fe86d0917ff | SHA-256 hash listed for a Windows Securotrop ransomware IOC. |
| SHA256 | bd1cf7823cabbac2ea7b45f2d7c9dfcd6b9a24714b6d40377bdef82b9c88021b | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| SHA256 | e76fb9cf2da75e963e4d00b48500f59fa6a0e7d21915b8c54ca3d83c52b9d43b | SHA-256 hash listed for a Windows Securotrop ransomware IOC. |
| SHA256 | e81e9a3a8baca74a5c73bb5d0904cd7ac145e330c4d4993bfd671f3396402416 | SHA-256 hash listed as a Windows Qilin ransomware IOC. |
| URL | hxxps[:]//wikileaks2[.]site/ | Leak-site URL used to publish data stolen by Qilin and its affiliates; the article notes the site is not owned by Qilin. |
MITRE ATT&CK
T1059.001 · PowerShellThe ransomware can execute a saved PowerShell script to disable cluster services and deploy payloads to ESXi hosts.T1078 · Valid AccountsThe article reports that affiliates commonly gain access using compromised VPN and RDP credentials.T1083 · File and Directory DiscoveryQilin enumerates storage devices and recursively traverses discovered volumes to find files for encryption.T1112 · Modify RegistryQilin modifies the EnableLinkedConnections registry policy to access mapped network drives across elevated and non-elevated sessions.T1133 · External Remote ServicesThe article identifies VPN and RDP as remote-access services through which affiliates commonly gain access.T1134.001 · Token Impersonation/TheftQilin duplicates process tokens and assigns an impersonation token to its current thread using SetThreadToken.T1135 · Network Share DiscoveryQilin enumerates existing network connections and mapped drives with net use and uses WNetOpenEnumW during drive discovery.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of vulnerable internet-facing applications as a common affiliate access method.T1485 · Data DestructionThe sample configuration enables destructive operations and zeroing or wiping by default; command-line switches can disable those behaviors.T1486 · Data Encrypted for ImpactQilin encrypts files on local, network, and virtual-machine resources, using AES-CTR or ChaCha20 and RSA-4096 to protect per-file keys.T1489 · Service StopQilin enumerates services and sends SERVICE_CONTROL_STOP to services not excluded by its embedded blacklist.T1490 · Inhibit System RecoveryBefore encryption, Qilin runs vssadmin.exe to delete all available Volume Shadow Copies.T1497.001 · System ChecksThe sample checks the CPUID hypervisor bit and virtualization-related registry keys to identify virtual machines; the article says this may also support sandbox detection.T1547.001 · Registry Run Keys / Startup FolderQilin creates a value under the current user's Windows Run registry key to automatically start the payload with its arguments.T1566 · PhishingThe article reports that Qilin affiliates commonly use targeted phishing to gain access.
Threat Actors
Moonstone SleetThe article says Qilin has been linked to Moonstone Sleet; it does not establish the nature or certainty of that link.QilinThe article identifies Qilin as a ransomware-as-a-service operation active since 2022 and describes its affiliates' ransomware attacks and double-extortion activity.Scattered SpiderThe article describes an alleged partnership between Qilin and Scattered Spider.securotropThe article says some Qilin operators established Securotrop as a separate RaaS operation; it remains part of the Qilin affiliate network while operating a separate data leak site.The GentlemenThe article says some Qilin operators established The Gentlemen as a separate RaaS operation, which later competed with Qilin.
Malware
Vendors
Products
Acronis EDR / XDRAcronis EDR / XDR detects and blocks this threat:AzureAn additional VM check is performed by reading registry keys that are usually present on Hyper-V or Azure virtual machines.ESXiInside Qilin ransomware: ESXi attacks, affiliate networks and double extortionMicrosoft Hyper-VAn additional VM check is performed by reading registry keys that are usually present on Hyper-V or Azure virtual machines.Microsoft WindowsThe Windows sample is a 4.69 MB PE32 executable — large for ransomware — with no resources and 6,598 identified functions.VMware vCenterSpread through the VMware vCenter infrastructure.
Tools
fsutil.exeThe sample modifies Windows symbolic-link evaluation settings using fsutil, enabling both Remote-to-Local (R2L) and Remote-to-Remote (R2R) symbolic-link resolution. This allows symbolic links encountered on remotePowerShellIf configured to target virtual machines, the sample executes a saved PowerShell script.vssadminBefore encryption, Qilin deletes all available Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet, preventing recovery of files through Volume Shadow Copy-based restoration mechanisms.
Countries
CanadaQilin appears to exclude organizations in Commonwealth of Independent States (CIS) countries and primarily targets organizations in the United States, Canada, Europe and other regions.United Kingdomof the most notable operations attributed to Qilin occurred in 2024, when the group attacked Synnovis, a U.K.-based provider of diagnostic and pathology services for healthcare organizations. The attack disruptedUnited StatesQilin appears to exclude organizations in Commonwealth of Independent States (CIS) countries and primarily targets organizations in the United States, Canada, Europe and other regions.