Qilin

Qilin (also known as Agenda) is a sophisticated ransomware-as-a-service (RaaS) operation that emerged in mid-2022, with significant activity escalating through 2023 and 2024. The group is known for its highly customizable ransomware written in both Rust and Golang, which targets Windows, Linux, and VMware ESXi environments. Qilin operates on an affiliate model, recruiting experienced cybercriminals to conduct attacks while the core group maintains the ransomware infrastructure and negotiation platform. Qilin has been particularly aggressive in targeting healthcare, manufacturing, critical infrastructure, and education sectors. Notable attacks include the June 2024 compromise of Synnovis, a pathology services provider in the UK, which severely disrupted NHS operations and healthcare services across London. The group has also targeted major organizations globally, demonstrating a preference for high-value targets with significant operational impact potential. The group's ransomware is notable for its speed of encryption, use of modern programming languages that complicate analysis and detection, and employment of double extortion tactics. Qilin has evolved to include triple extortion methods, threatening DDoS attacks and direct contact with victims' customers and partners. Their leak site, hosted on the dark web, regularly publishes victim data to pressure organizations into paying ransoms, often releasing sensitive data incrementally to maintain pressure. Qilin affiliates typically gain initial access through compromised credentials, exploitation of VPN and remote access vulnerabilities (including Citrix and VPN appliances), phishing campaigns, and supply chain compromises. The group has shown increasing sophistication over time, including the development of Qilin.B (an improved variant), enhanced evasion capabilities against EDR solutions, and the use of legitimate administrative tools for lateral movement and persistence. In 2024, the group introduced a new variant targeting Chrome browser data to steal credentials stored in browsers. Their operations have resulted in significant financial and operational impacts across multiple industries globally, with ransom demands often exceeding millions of dollars.