9 min to read

Qilin (Agenda) Ransomware Explained: Real‑World Attack Timeline & 7 Fast Defenses

Stop Double‑Extortion Attacks Before They Start

Featured image

TL;DR — Qilin (formerly Agenda) is a cross‑platform, double‑extortion ransomware written in Go and Rust.

Coffee break—before the chaos

1 — Why You Should Care

You’re sipping your morning coffee, casually scanning your dashboards. Then something strange catches your eye — unfamiliar file extensions, odd filenames. A few virtual machines suddenly go dark. Moments later, a message pops up in your inbox: a ransom note. No, this isn’t a Netflix plot. This is ransomware — and not just any strain. We’re talking about Qilin, also known as Agenda. In this blog, I’ll guide you through a detailed hypothetical attack scenario rooted in real-world tactics used by this ransomware group. We’ll explore how these attacks unfold, highlight common weaknesses that threat actors exploit, and provide clear actions you can take to strengthen your defenses. This isn’t fear-mongering. It’s preparation — the kind every organization should take seriously.

As of now, Qilin has publicly claimed responsibility for over 437 victims, and that number is still growing — according to ransomware.live.

🧬 What Is Qilin (aka Agenda) Ransomware?

Qilin, previously tracked as Agenda, is a ransomware-as-a-service (RaaS) operation that surfaced in mid-2022. It is written in both Go and Rust, and is capable of targeting both Windows and Linux systems — including VMware ESXi.

Victims are often hit with highly customized payloads — operators configure what files to skip, services to disable, and when encryption should trigger.

The group later rebranded from Agenda to Qilin, evolving its tooling, improving detection evasion, and expanding affiliate adoption.

Targeted Industries:

Double Extortion Tactics:

  1. Data Encryption – Files are encrypted using AES-256 and RSA-2048.
  2. Data Exfiltration – Stolen data is used for leverage via public leaks if ransom is not paid.

2.1 Evolution

2.2 How Double Extortion Works

  1. Encryption — Files are locked with AES‑256, keys protected by RSA‑2048.
  2. Data theft — Sensitive documents are exfiltrated during the breach.
  3. Leverage — Refuse to pay and the data is published on the leak portal.

🧨 How Qilin Executes Each Step – From Initial Access to Impact

Understanding Qilin’s attack chain isn’t just about listing tactics — it’s about knowing how and when they’re used in real intrusions. Below is a walkthrough of how each MITRE ATT&CK tactic might play out during a typical Qilin campaign, based on observed behavior.

🕵️ Abuse of Kickidler Monitoring Software

Qilin affiliates have been observed abusing Kickidler, a legitimate employee-monitoring software, to enhance their visibility post-compromise.

After gaining access (often via a trojanized RVTools installer hosted on rv-tool[.]net), attackers deploy a PowerShell loader called SMOKEDHAM. This backdoor then installs Kickidler — allowing the attacker to:

Originally built for workplace monitoring, Kickidler’s screen recording and session replay features are repurposed for credential theft, reconnaissance, and even backup system access.

📎 Source: BleepingComputer – Kickidler Abuse in Ransomware Attacks

🧰 Observed Tool Chain:

These tactics show how attackers increasingly rely on living-off-the-land and legitimate software abuse to bypass defenses and stay under the radar.

🛠 Initial Access

Techniques:

It starts quietly. A phishing email mimicking Dropbox or invoicing software arrives — or an IT staffer unknowingly installs a trojanized version of RVTools from rv-tool[.]net. In other cases, attackers log in directly using purchased or reused RDP credentials.
Source: SentinelOne

🧬 Execution

Technique:

Once inside, Qilin drops custom payloads using native scripting tools. A PowerShell command silently downloads NETXLOADER, which pulls in the ransomware binary — all without triggering traditional antivirus.
Source: Sophos

T1547.001 – Registry Run Keys / Startup Folder
In at least one documented case, Qilin’s loader disguised itself as a Windows “SystemHealthMonitor” tool and used the Registry Run key to establish persistence:

New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" `
  -Name "SystemHealthMonitor" `
  -Value "C:\Windows\System32\wscript.exe //B //E:jscript C:\ProgramData\svchost.js" `
  -PropertyType String -Force

This allowed the malicious script (svchost.js) to execute automatically on startup.

🔗 Source: Cyber Security News – Qilin Tops April 2025

🔓 Privilege Escalation

Technique:

They don’t wait for permission. Qilin brings their own vulnerable drivers (BYOVD) — like Zemana AntiMalware or Toshiba power drivers — to disable security tools and gain SYSTEM-level access.

🎭 Defense Evasion

Technique:

Using renamed binaries like upd.exe (a spoof of legitimate AV updaters), Qilin disables EDR, clears logs, and bypasses detection. The malware might even exploit outdated Carbon Black Cloud sensors to remain hidden.

🛂 Credential Access

Technique:

Once elevated, Qilin dumps LSASS memory and extracts credentials from browsers like Chrome. These are used to access other systems silently.
Source: Sophos Report on Chrome Theft

🔄 Lateral Movement

Technique:

With credentials in hand, Qilin moves laterally across the network using SMB, RDP, WinRM, and PsExec.
IT tools like ScreenConnect and AnyDesk are sometimes hijacked to extend access.

💥 Impact

Technique:

When ready, Qilin triggers its payload. Files are encrypted with .qilin or .qln extensions.
Ransom notes like README.txt or qilin_readme.txt appear across file shares and desktop paths.
Backups, if reachable, are targeted and encrypted first.

ℹ️ If the technique IDs look cryptic, they’re part of the MITRE ATT&CK framework — a public catalog of adversary behavior used across cybersecurity.

🧠 Lessons Learned

Credential Hygiene

Network Design

Backup Safety

Comms Plan

Decision Paralysis

🧪 Indicators of Compromise (IOCs)

Below are the observed IOCs associated with Qilin/Agenda ransomware from multiple trusted sources including SentinelOne, HHS, Sophos, Blackpoint Cyber, and Cyble.

📁 File Names

Source: SentinelOne, Blackpoint Cyber, Sophos

🔐 SHA-256 Hashes

Source: SentinelOne, Rewterz, Blackpoint Cyber

🌐 Domains and IPs (Used for Payload Delivery or C2)

Source: Cyble, SentinelOne

🔗 Leak Site (Tor)

Source: ransomware.live, Blackpoint Cyber

These IOCs should be monitored across:

⚠️ Note: Always verify IOCs with internal telemetry to avoid false positives. Use them in conjunction with behavioral detections for maximum effectiveness.

🧼 Cyber Hygiene Tips That Actually Work

✅ What Helped Most

🎯 Final Thoughts

You don’t need perfect. You need ready.

Qilin isn’t unique in how it attacks — but in how well it exposes your gaps. The lesson?

You don’t rise to the level of your plan. You fall to the level of your training.

Run a tabletop. Review your backups. Update your response tree.

tabletop

You’ve got time now. Use it.

Stay safe. Stay ready.

📚 Further Reading & Sources