Qilin Ransomware Group Expands Cross-Platform Operations and Extortion Tactics
Summary
An analysis of Qilin’s growth as a ransomware-as-a-service operation details its Windows, Linux, and ESXi capabilities, intrusion techniques, extortion methods, targeted sectors, and recommended defenses.
Key points
- Qilin emerged as Agenda in 2022 and operates a ransomware-as-a-service platform, with affiliates carrying out intrusions.
- The group has expanded from a Golang encryptor to Rust-based ransomware targeting Windows, Linux, and VMware ESXi.
- Reported access methods include exploiting public-facing vulnerabilities, social engineering, stolen credentials, and VPNs without MFA.
- Its intrusion activity includes credential theft, disabling security tools, lateral movement, and data exfiltration before encryption.
- Qilin uses double extortion and has added DDoS pressure and a negotiation feature intended to emphasize victims’ legal and regulatory exposure.
- The article reports frequent targeting of manufacturing, technology, healthcare, and construction organizations across multiple countries.
- Recommended defenses include timely patching, MFA, monitoring privileged-account changes, tested incident response, and offline or immutable backups.
Article Details
- Attack Vectors
- Exploitation of public-facing vulnerabilities CVE-2024-21762 and CVE-2024-55591.
- ClickFix social engineering campaigns that lead to StealC v2 infections.
- Use of leaked or stolen administrative credentials and VPN access where MFA is not enforced.
- Modification of Active Directory Group Policy Objects to enable RDP.
- Persistence through Registry Run keys, scheduled tasks, backdoor administrative accounts, and registry-based RDP settings.
- Privilege escalation by adding attacker-controlled accounts to the local Administrators group.
- Credential theft through LSASS memory dumping, enabling WDigest plaintext credential storage, and harvesting credentials from Veeam backup infrastructure.
- Lateral movement using PsExec, RDP, SSH, Active Directory administrative tools, and network scanning.
- Data staging and exfiltration using easyupload[.]io and custom scripts that send data through SMTP.
- Encryption of local and network-accessible files, deletion of shadow copies, and disabling recovery mechanisms.
- Defensive Notes
- Provide security awareness training focused on phishing and social engineering, with a clear process for reporting suspected incidents.
- Patch systems and applications promptly; enforce strong passwords and MFA, particularly for remote access and privileged accounts.
- Monitor for unauthorized account creation, privilege escalation, and unexpected changes to administrative groups.
- Use endpoint protection, SIEM monitoring, network segmentation, identity controls, and email and web filtering.
- Maintain and test an incident response plan, including regular tabletop exercises.
- Follow a 3-2-1 backup strategy and keep at least one offline or immutable backup.
- Centralize logging in a SIEM and deploy network detection to identify command-and-control activity and lateral movement.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article says Qilin operators dump LSASS memory to extract credentials.T1018 · Remote System DiscoveryThe article describes enumerating domain-joined systems and retrieving their DNS hostnames.T1021.001 · Remote Desktop ProtocolRDP is listed as a lateral movement method.T1021.004 · SSHSSH is listed as a lateral movement method.T1046 · Network Service DiscoveryThe article describes using Netscan and other utilities to scan for reachable systems and exposed services.T1048 · Exfiltration Over Alternative ProtocolThe article describes exfiltrating data through SMTP using custom scripts.T1053 · Scheduled Task/JobScheduled tasks are listed as a persistence method.T1059.001 · PowerShellThe article describes PowerShell use with the ActiveDirectory module to enumerate domain-joined systems.T1059.003 · Windows Command ShellThe article describes use of Windows command-line utilities, including net, for domain enumeration and account changes.T1070 · Indicator RemovalThe article reports clearing Windows Event Logs to remove forensic traces.T1078 · Valid AccountsThe article reports access through leaked or stolen administrative credentials.T1098 · Account ManipulationThe article reports adding attacker-controlled accounts to the local Administrators group.T1112 · Modify RegistryThe article describes modifying registry-based RDP settings.T1133 · External Remote ServicesThe article says Qilin compromises VPN infrastructure where MFA is not enforced.T1136 · Create AccountThe article reports creating backdoor administrative accounts.T1219.002 · Remote Desktop SoftwareThe article describes using ScreenConnect and AnyDesk through Atera agents for discovery activity.T1222.001 · Windows PermissionsThe article describes creating network shares with permissive access controls.T1482 · Domain Trust DiscoveryThe article reports enumerating Active Directory trust relationships.T1486 · Data Encrypted for ImpactQilin encrypts local and network-accessible files.T1490 · Inhibit System RecoveryThe article reports deleting shadow copies and disabling recovery mechanisms.T1547.001 · Registry Run Keys / Startup FolderThe article reports creating Registry Run keys for persistence.T1560.001 · Archive via UtilityThe article says collected data is archived with WinRAR before exfiltration.T1562.001 · Disable or Modify ToolsThe article reports disabling AMSI protections and using BYOVD tools to disable security protections.T1566 · PhishingThe article describes social engineering campaigns such as ClickFix as an initial access method.T1567.002 · Exfiltration to Cloud StorageThe article identifies easyupload[.]io as a public file-sharing service used for data staging and exfiltration.
CVE
Threat Actors
Malware
Products
Active DirectoryModifies Active Directory Group Policy Objects (GPOs) to enable Remote Desktop Protocol (RDP) for deeper network access.LinuxOver time, Qilin expanded its capabilities to support cross-platform encryption across Windows, Linux, and VMware ESXi environments.Microsoft WindowsOver time, Qilin expanded its capabilities to support cross-platform encryption across Windows, Linux, and VMware ESXi environments.VeeamHarvests credentials from Veeam backup infrastructureVMware ESXiOver time, Qilin expanded its capabilities to support cross-platform encryption across Windows, Linux, and VMware ESXi environments.Windows Subsystem for LinuxDemonstrates cross-platform capabilities, including executing Linux ransomware payloads via Windows Subsystem for Linux (WSL).WinRARArchives collected data using WinRAR prior to exfiltration.
Tools
AnyDeskInstalls and abuses Remote Management Tools (RMM) including ScreenConnect and AnyDesk via Atera agents to execute discovery commands and blend activity with legitimate administrative operations.AteraInstalls and abuses Remote Management Tools (RMM) including ScreenConnect and AnyDesk via Atera agents to execute discovery commands and blend activity with legitimate administrative operations.DarkKillUses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security protections, deploying tools such as DarkKill and HRSword to terminate EDR solutions.HRSwordUses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security protections, deploying tools such as DarkKill and HRSword to terminate EDR solutions.MimikatzUses credential dumping tools such as Mimikatz and SharpDecryptPwdnetscanDeploys network scanning tools such as Netscan to identify reachable systems and exposed services.PsExecUses PsExec, RDP, SSH, and Active Directory administrative tools.ScreenConnectInstalls and abuses Remote Management Tools (RMM) including ScreenConnect and AnyDesk via Atera agents to execute discovery commands and blend activity with legitimate administrative operations.SharpDecryptPwdUses credential dumping tools such as Mimikatz and SharpDecryptPwd
Countries
CanadaThe group’s victim footprint spans globally, with the United States, France, Canada, the United Kingdom, and Spain among the most frequently targeted countries.FranceThe group’s victim footprint spans globally, with the United States, France, Canada, the United Kingdom, and Spain among the most frequently targeted countries.GermanyThe United States, United Kingdom, Germany, Canada and Spain account for the highest number of reported victims, demonstrating the group’s broad international footprint.RussiaOriginally identified as “Agenda” in mid-2022, Qilin is a Russia-based ransomware group that later rebranded and evolved into a mature Ransomware-as-a-Service (RaaS) platform.SpainThe group’s victim footprint spans globally, with the United States, France, Canada, the United Kingdom, and Spain among the most frequently targeted countries.United KingdomThe group’s victim footprint spans globally, with the United States, France, Canada, the United Kingdom, and Spain among the most frequently targeted countries.United StatesThe group’s victim footprint spans globally, with the United States, France, Canada, the United Kingdom, and Spain among the most frequently targeted countries.
Industries
ConstructionQilin has consistently targeted high-impact industries such as manufacturing, healthcare, technology, and construction sectors where operational downtime generates significant financial and operational pressure.HealthcareQilin has consistently targeted high-impact industries such as manufacturing, healthcare, technology, and construction sectors where operational downtime generates significant financial and operational pressure.ManufacturingQilin has consistently targeted high-impact industries such as manufacturing, healthcare, technology, and construction sectors where operational downtime generates significant financial and operational pressure.TechnologyQilin has consistently targeted high-impact industries such as manufacturing, healthcare, technology, and construction sectors where operational downtime generates significant financial and operational pressure.