Qilin is a ransomware-as-a-service operation whose affiliates mostly get in with stolen or phished credentials, steal data, then disable defences and encrypt Windows, Linux and VMware ESXi systems. This profile draws on MITRE ATT&CK, the US Department of Health and Human Services HC3 threat profile, NHS England, Cisco Talos and Sophos to describe how affiliates operate and which controls break their playbook. It is for security operations, identity and infrastructure teams, and for managed service providers whose remote tools have been used to reach customers. Because affiliates differ, techniques vary between intrusions; attribution follows each source's wording, and the page avoids leak-site content.
Key takeaways
- Credentials are the usual way in. Talos assesses with moderate confidence that one intrusion began with administrative VPN credentials exposed on the dark web on a VPN without MFA, and Sophos documented MFA-bypassing phishing of an MSP administrator.
- One MSP account can reach many customers. Sophos describes an affiliate taking super administrator access to an MSP's ScreenConnect tenant and deploying Qilin across multiple customer environments.
- Backups and hypervisors are deliberate targets. Sources describe Veeam credential theft via CVE-2023-27532, shadow copy deletion and scripts that change ESXi root passwords through vCenter.
- Defence impairment is routine. Affiliates reboot into Safe Mode (T1688), uninstall or kill endpoint agents and clear event logs (T1685.005) before encryption.
- The countermeasures are identity first. Phishing-resistant MFA on remote access and RMM consoles, no plaintext credential caching, tiered admin accounts and isolated backup credentials address most of the documented path.
Who they are (names and aliases)
MITRE ATT&CK tracks Qilin as software S1242, a ransomware family run as a ransomware-as-a-service (RaaS) operation since at least 2022, with variants written in Go and Rust that target Windows, Linux and VMware ESXi. MITRE notes functional overlaps with Black Basta, REvil and BlackCat ransomware. It does not track a single Qilin group, because the people who break in are affiliates.
| Name | Source | How the source relates it to Qilin |
|---|---|---|
| Qilin (S1242), alias Agenda | MITRE ATT&CK | Ransomware family and RaaS, active since at least 2022 |
| Agenda | HHS HC3 threat profile (June 2024) | Original name at launch in July 2022; rebranded Qilin by September 2022 |
| Qilin.B | Cisco Talos | Variant name used for the encryptors analysed in its 2025 cases |
| STAC4365 | Sophos | Activity cluster assessed with high confidence to be a Qilin affiliate |
Operating model: HC3 reports that affiliates receive 15 to 20 per cent of proceeds, that affiliate recruitment was observed in October 2023, and that targeting of Commonwealth of Independent States countries is excluded. Talos notes Cyrillic encoding in some scripts but cautions this could be a false flag. See the Ransomware Groups Guide for how RaaS affiliate models work.
Targeting and motivation
- Motivation: financial, through double extortion: data theft followed by encryption and threatened publication (HC3, Talos).
- Opportunistic selection: HC3 describes targeting as opportunistic. MITRE records a majority of victims in the US, France, Canada and the UK, mainly in manufacturing, technology, financial services and healthcare.
- Healthcare: HC3 identified at least 15 health sector incidents between October 2022 and June 2024, about half in the US, and cites the 3 June 2024 attack on a UK pathology provider that disrupted several London hospitals.
- Service providers as multipliers: the Sophos case shows affiliates targeting MSPs to reach many downstream customers in one operation. See the Compromised MSP Playbook.
Tactics and techniques (MITRE ATT&CK)
All IDs are ATT&CK v20 entries verified against MITRE's dataset. Most appear in MITRE's S1242 list; T1078, T1133, T1557, T1555 and T1567.002 are our mapping of behaviour described in the Talos and Sophos reports. The table shows what sources describe, not a complete list.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1078 Valid Accounts; T1133 External Remote Services | Admin VPN credentials exposed online, VPN without MFA (Talos, moderate confidence) | Phishing-resistant MFA on all remote access |
| Initial access | T1566.002 Spearphishing Link; T1557 Adversary-in-the-Middle | Fake ScreenConnect security alert leading to an evilginx proxy that captured password and TOTP (Sophos) | FIDO2 for admin consoles; DMARC enforcement |
| Initial access | T1190 Exploit Public-Facing Application | Exposed applications such as Citrix and RDP (HC3); in MITRE's S1242 list | Patch KEV entries on edge devices first |
| Command and control | T1219.002 Remote Desktop Software | Rogue ScreenConnect instance pushed to customers (Sophos); AnyDesk, Chrome Remote Desktop, QuickAssist and ScreenConnect traces (Talos) | Allowlist approved RMM tools |
| Credential access | T1003.001 LSASS Memory; T1555 Credentials from Password Stores | Mimikatz, NirSoft tools, WDigest UseLogonCredential set to 1, saved credentials from WinSCP, FileZilla, browsers and RDCMan (Talos) | Credential Guard; block WDigest; LSASS protection |
| Lateral movement | T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer | PsExec to run encryptors remotely; a share exposing C: to Everyone (Talos) | Tiered admin accounts; block admin shares between workstations |
| Privilege escalation | T1484.001 Group Policy Modification | Group Policy changes enabling RDP (Talos); in S1242 list | Alert on GPO changes |
| Defence impairment | T1688 Safe Mode Boot; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs | Safe Mode reboot (Sophos); EDR uninstallers, vulnerable driver and HRSword; event logs cleared (Talos) | Tamper protection; forward logs off-host |
| Persistence | T1053.005 Scheduled Task; T1547.001 Registry Run Keys | Task "TVInstallRestore" and Run key starting an encryptor disguised as TeamViewer (Talos) | Monitor new tasks and Run keys on servers |
| Lateral movement | T1021.004 SSH | vCenter script enabled SSH on ESXi hosts and changed root passwords (Talos) | Lockdown mode; separate vCenter identity |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | WinRAR archives uploaded with Cyberduck to Backblaze (Talos) or to easyupload.io (Sophos) | Egress filtering; block unsanctioned storage |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery | Encryption of hosts, shares and Hyper-V storage; shadow copies deleted | Immutable, isolated backups |
How they abuse identities and credentials
Human and administrator identities
- Remote access without MFA: exposed VPN credentials only work where the VPN accepts a password alone. See the VPN Security Guide.
- MFA that can be relayed: the Sophos case defeated TOTP with an adversary-in-the-middle proxy. Only phishing-resistant methods bound to the real origin stop this. See the AiTM Phishing Guide and the Phishing-Resistant MFA Guide.
- Mass password resets: after access, the Sophos affiliate reset numerous user credentials in customer environments, locking out defenders as well as users.
Machine credentials and infrastructure accounts
- RMM super administrators: one compromised ScreenConnect super admin gave reach into every managed customer. RMM consoles are privileged identities in their own right. See the RMM Tool Security Guide.
- Backup service credentials: Sophos records a tool exploiting CVE-2023-27532, a Veeam Backup & Replication missing authentication flaw listed in the CISA KEV catalogue with known ransomware use, to obtain stored Veeam credentials. See the Backup Identity Isolation Guide.
- Hardcoded domain credentials: Talos found encryptor configurations containing environment-specific domain credentials, showing that domain admin access had already been obtained before deployment.
- Hypervisor root: changing ESXi root passwords through vCenter shows why vCenter should not trust domain admin groups. See the VMware ESXi Hardening Guide.
- Stored application secrets: SharpDecryptPwd harvested saved credentials from file transfer and remote access tools, many of them service or shared accounts.
Notable incidents
| Incident or campaign | What the source says | Attribution as published |
|---|---|---|
| Synnovis pathology services, London, 3 June 2024 | NHS England confirmed a ransomware attack on Synnovis that stopped some blood testing systems in south-east London, with postponed operations and appointments; the NCSC worked with the National Crime Agency to verify published data. BleepingComputer reports 800 planned operations and 700 outpatient appointments cancelled. | NHS England refers to "a cyber criminal group"; Ciaran Martin, former NCSC chief executive, linked it to Qilin (reported by BleepingComputer); HC3 cites the attack in its Qilin profile |
| MSP compromise via ScreenConnect, January 2025 | Phished MSP administrator, rogue ScreenConnect deployed to customers, Veeam credentials stolen, data exfiltrated and Qilin deployed across customers with unique passwords | Sophos: STAC4365, high confidence Qilin affiliate |
| Multiple intrusions analysed in 2025 | VPN credential access, credential dumping, EDR removal, vCenter and ESXi manipulation, dual encryptors | Cisco Talos, from its incident response cases |
For a related pattern of credential-led ransomware entry, compare the Change Healthcare Breach 2024, a different actor but the same lesson: a single remote access login without MFA. See the Healthcare Identity Security Guide.
Detection and defence
Detection signals
| Signal | Where to look | Why it matters |
|---|---|---|
| Successful VPN or RMM logins from new locations or devices, especially admin accounts | VPN, identity provider and RMM audit logs | Matches credential-based entry (Talos, Sophos) |
| New RMM agent or instance not issued by IT | EDR software inventory, network traffic (Talos saw ScreenConnect on port 8880) | Rogue remote access (T1219.002) |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest UseLogonCredential set to 1 | Registry auditing, EDR | Plaintext credentials kept in memory for theft |
| bcdedit changes to boot into Safe Mode, unexpected reboots | EDR and Windows System log | T1688 used to run outside endpoint protection |
| Event ID 1102 (Security log cleared) and 104 (System log cleared) | SIEM, with logs forwarded off-host | T1685.005 before impact |
| Endpoint agent uninstall or service stop, new kernel driver load | EDR tamper alerts, Sysmon Event ID 6 | EDR removal before encryption |
| vCenter changes disabling HA or DRS, ESXi SSH enabled, root password change | vCenter events, ESXi syslog | Hypervisor takeover |
| Large uploads to file-sharing or cloud storage from servers | Proxy and firewall logs | Exfiltration before encryption |
Defences in priority order
- Close password-only remote access: require phishing-resistant MFA on VPN, RDP gateways, RMM consoles and cloud admin portals; remove dormant VPN accounts.
- Harden RMM: one approved tool, MFA on every console, alerting on new super admins and new agent deployments, and blocking of unapproved remote tools.
- Protect credentials on endpoints: enforce WDigest off, enable Credential Guard and LSA protection, and remove saved passwords from admin tools.
- Tier administration: separate workstation, server, domain and hypervisor admin accounts so a single theft does not reach everything.
- Isolate backups: patch backup servers (KEV first), keep backup credentials outside the production domain and keep an immutable copy.
- Make tampering loud: tamper protection on EDR, logs forwarded off-host, alerts on Safe Mode boot configuration.
- Restrict egress: block unsanctioned file-sharing and cloud storage from servers.
Metrics
- Remote access MFA coverage: share of VPN, RMM and admin portal accounts on phishing-resistant MFA.
- Unapproved RMM detections: count per month, and time to removal.
- Credential exposure: hosts with WDigest enabled or without LSASS protection (target zero).
- Backup isolation: share of backup systems on separate credentials with an immutable copy tested in the last quarter.
- Tamper alert response: median minutes from EDR tamper or log-clear alert to triage.
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| MFA on remote and admin access | IA-2, AC-17 | PR.AA-05 |
| Least privilege and admin tiering | AC-6 | PR.AA-05 |
| Limit tools and remote software | CM-7 | PR.PS-02 |
| Monitoring and log review | SI-4, AU-6 | DE.CM-01, DE.CM-09 |
| Backups and recovery | CP-9 | PR.DS-11 |
| Incident handling | IR-4 | RS.MA-01 |
This mapping is our own alignment of the defences above to control IDs, not a mapping published by HHS, CISA or NIST.
Common failure patterns
- Password-only VPN accounts: legacy or contractor accounts left without MFA, which Talos assesses was the likely entry in its case.
- TOTP treated as phishing-proof: codes relayed through a proxy page are as useful to the attacker as the password.
- RMM sprawl: several remote tools installed, so a new one does not stand out.
- Backups in the same identity domain: backup servers joined to production with reachable credentials, so theft of one admin account reaches both.
- Logs only on the host: cleared event logs remove the evidence when nothing was forwarded.
Practitioner checklist
- Require phishing-resistant MFA on every VPN, RMM and administrative portal account, and disable password-only fallbacks.
- Remove dormant remote access accounts and review VPN account lists monthly.
- Allowlist a single RMM tool and alert on any other remote access software.
- Set WDigest UseLogonCredential to 0 by policy and enable Credential Guard and LSA protection.
- Separate admin tiers for workstations, servers, domain and hypervisors.
- Patch backup and edge systems in the CISA KEV catalogue first and isolate backup credentials.
- Turn on EDR tamper protection and forward Windows and ESXi logs off-host.
- Alert on Safe Mode boot configuration changes, new kernel drivers and vCenter HA or DRS changes.
- Block uploads from servers to unsanctioned file-sharing and storage services.
- If you are an MSP or use one, agree how a compromised RMM tenant would be contained.
Standards and references
- HHS HC3: Threat Profile: Qilin, aka Agenda Ransomware
- NHS England: Synnovis cyber attack statement from NHS England
- MITRE ATT&CK: Qilin (S1242)
- CISA: Known Exploited Vulnerabilities Catalog
- Cisco Talos: Uncovering Qilin attack methods exposed through multiple cases
- Sophos: Sophos MDR tracks ongoing campaign by Qilin affiliates targeting ScreenConnect
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cl0p Threat Actor Profile · ESXi Ransomware Playbook · EDR Evasion and Defence Guide · Ransomware Response and Recovery Guide