← All threat actors
Qilinmalware / toolS1242 ↗
VirusTotal tracks this as AgendaCrypt.
Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments.
Reports / IOCs (VT)
242 reports · 194 IOCs
Reported activity
2022 – 2026
ATT&CK techniques in reports
- T1041 Exfiltration Over C2 Channel3
- T1005 Data from Local System2
- T1027 Obfuscated Files or Information2
- T1036 Masquerading2
- T1059.001 PowerShell2
- T1059.003 Windows Command Shell2
- T1071.001 Web Protocols2
- T1078 Valid Accounts2
- T1082 System Information Discovery2
- T1105 Ingress Tool Transfer2
- T1490 Inhibit System Recovery2
- T1567.002 Exfiltration to Cloud Storage2
- T1589.002 Email Addresses2
- T1059 Command and Scripting Interpreter2
- T1190 Exploit Public-Facing Application2
- T1486 Data Encrypted for Impact2
- T1055 Process Injection1
- T1001.003 Protocol or Service Impersonation1
- T1008 Fallback Channels1
- T1010 Application Window Discovery1
Also known as
Agenda, Qilin