Qilin is a Russian-speaking cybercrime organization and ransomware-as-a-service (RaaS) group that first emerged in July/August 2022, initially operating under the name “Agenda” before rebranding as Qilin. The group is known for its sophisticated and aggressive tactics, targeting organizations across multiple sectors—especially healthcare, manufacturing, education, and critical infrastructure—in countries including the UK, US, Canada, France, Japan, Brazil, and others.
Key Features and Tactics
Qilin provides affiliates with customizable ransomware tools and infrastructure, taking a 15–20% cut of ransom payments. The group exfiltrates sensitive data before encrypting systems, then threatens to release the stolen data unless a ransom is paid—sometimes publishing data even if the ransom is paid. Qilin uses kernel-level exploits, process injection, and Bring-Your-Own-Vulnerable-Driver (BYOVD) methods to bypass and disable security controls.
Initial access it typically gained through compromised VPNs, phishing emails, or exploiting vulnerabilities in exposed services (e.g., Fortinet devices). Persistence achieved via scheduled tasks, group policy manipulation, and registry run key modifications.
Notably, Qilin affiliates can tailor ransomware payloads for specific targets, adjust ransom amounts, and control deployment timing.