RansomwareSOCRadar source-of-truth import; pending cross-source consensus confidence

Qilin

Qilin is a financially motivated ransomware-as-a-service (RaaS) operation that first emerged in June 2022 under the name "Agenda" and rebranded to "Qilin" by September 2022. The group shifted to a RaaS model in February 2023, offering its tools and infrastructure to affiliates. Qilin is assessed with moderate confidence to be of Russian or Eastern European origin, indicated by its policy of avoiding targets in Commonwealth of Independent States (CIS) countries and use of Russian-language forums for affiliate recruitment. Its primary motivation is financial gain through double extortion, involving both data encryption and exfiltration. What sets Qilin apart is its cross-platform capability, utilizing ransomware variants written in both Golang and Rust to target Windows, Linux, and VMware ESXi systems, along with a highly customizable approach that allows affiliates to tailor attacks, encryption methods, and evasion techniques to specific victims. The group's notable growth and activity in 2025 and 2026 have positioned it as one of the most prolific RaaS groups.

Directory Briefing

Top 10 Talking Points

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.¹

The operators supply adaptable ransomware and infrastructure while affiliates conduct intrusions, so access methods and dwell behavior can vary across incidents.

Double extortion is central to Qilin's leverage.^1,2

Affiliates steal sensitive information before encryption and use the threat of publication to preserve pressure even when a victim can restore systems.

Initial access commonly combines identity and edge exposure.^1,2

The retained record includes stolen credentials, phishing, exposed RDP and VPN services, and exploitation of Internet-facing appliances rather than dependence on one exploit path.

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.^1,2

Qilin affiliates perform reconnaissance, steal credentials, move laterally, stage data, and prepare high-value systems before the ransomware payload becomes visible.

Windows, Linux, and VMware ESXi environments can all be affected.^1,2

Cross-platform encryptors let affiliates concentrate impact on virtual infrastructure and server estates rather than limiting damage to Windows endpoints.

Legitimate tools help Qilin blend into normal administration.^1,2

PowerShell, PsExec, SSH, RMM utilities, WinSCP, Splashtop, and archive tools can support execution, lateral movement, and staging with fewer obvious malware signals.

Qilin deliberately attacks security controls before encryption.^1,2

Documented behavior includes EDR impairment, vulnerable-driver abuse, service termination, and event-log clearing, which can reduce both prevention and forensic visibility.

Recovery infrastructure is part of the target set.^1,2

Deletion of volume shadow copies and other recovery-inhibition behavior means domain-connected or mutable backups should not be assumed trustworthy after compromise.

Qilin's victimology is broad and commercially opportunistic.^1,2

The retained record spans Construction of Buildings, Food Manufacturing, Other Information Services, Software Publishers, and Real Estate, so no single sector defines the risk.

Successful recovery must address both business interruption and stolen data.^1,2

System restoration does not close notification, contractual, privilege, insurance, communications, or reputational questions created by exfiltration.

Bottom Line Up Front

BLUF

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.¹

The operators supply adaptable ransomware and infrastructure while affiliates conduct intrusions, so access methods and dwell behavior can vary across incidents.

Double extortion is central to Qilin's leverage.^1,2

Affiliates steal sensitive information before encryption and use the threat of publication to preserve pressure even when a victim can restore systems.

Initial access commonly combines identity and edge exposure.^1,2

The retained record includes stolen credentials, phishing, exposed RDP and VPN services, and exploitation of Internet-facing appliances rather than dependence on one exploit path.

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.^1,2

Qilin affiliates perform reconnaissance, steal credentials, move laterally, stage data, and prepare high-value systems before the ransomware payload becomes visible.

Windows, Linux, and VMware ESXi environments can all be affected.^1,2

Cross-platform encryptors let affiliates concentrate impact on virtual infrastructure and server estates rather than limiting damage to Windows endpoints.

Legitimate tools help Qilin blend into normal administration.^1,2

PowerShell, PsExec, SSH, RMM utilities, WinSCP, Splashtop, and archive tools can support execution, lateral movement, and staging with fewer obvious malware signals.

Qilin deliberately attacks security controls before encryption.^1,2

Documented behavior includes EDR impairment, vulnerable-driver abuse, service termination, and event-log clearing, which can reduce both prevention and forensic visibility.

Recovery infrastructure is part of the target set.^1,2

Deletion of volume shadow copies and other recovery-inhibition behavior means domain-connected or mutable backups should not be assumed trustworthy after compromise.

Qilin's victimology is broad and commercially opportunistic.^1,2

The retained record spans Construction of Buildings, Food Manufacturing, Other Information Services, Software Publishers, and Real Estate, so no single sector defines the risk.

Successful recovery must address both business interruption and stolen data.^1,2

System restoration does not close notification, contractual, privilege, insurance, communications, or reputational questions created by exfiltration.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

Ransomware profile

First Seen¹

2022-06-01

Last Seen¹

2026-06-16

Origin¹

Motivation¹

Financially motivated ransomware/extortion

Primary Access Pattern¹

T1486

Objective¹

Financially motivated ransomware/extortion

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

agenda

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

United Arab EmiratesAlbaniaAngolaArgentinaAustriaAustraliaArubaAzerbaijanBosnia and HerzegovinaBarbadosBangladeshBelgiumBolivia, Plurinational State ofBrazilBahamasCanadaSwitzerlandChileChinaColombiaCyprusCzech RepublicGermanyDenmarkDominican RepublicAlgeriaEcuadorEstoniaEgyptSpainEthiopiaFinlandFijiFranceGabonUnited KingdomGuernseyGhanaGreeceGuatemalaHong KongHondurasCroatiaHaitiHungaryIndonesiaIrelandIsraelIsle of ManIndiaIran, Islamic Republic ofItalyJerseyJamaicaJordanJapanKenyaKorea, Republic ofKuwaitLiberiaLuxembourgLibyaMoroccoMadagascarMyanmarMacaoMontserratMaltaMauritiusMexicoMalaysiaMozambiqueNamibiaNigerNicaraguaNetherlandsNorwayNew ZealandOmanPeruPhilippinesPakistanPolandPortugalPalauParaguayQatarRomaniaSerbiaRussian FederationSaudi ArabiaSwedenSingaporeSloveniaSenegalEl SalvadorSwazilandThailandTimor-LesteTunisiaTurkeyTrinidad and TobagoTaiwan, Province of ChinaUkraineUgandaUnited StatesUruguayVenezuela, Bolivarian Republic ofVietnamYemenSouth AfricaGlobal

Target Sectors^1,2

Construction of BuildingsFood ManufacturingOther Information ServicesSoftware PublishersReal EstateHospitalsAccommodationAir TransportationManufacturingConstructionElectrical Equipment, Appliance, and Component ManufacturingPublic AdministrationAdministrative &Waste ManagementOil & GasBeverag & Tobacco ManufacturingEducational ServicesWholesale TradeTextile & Fabric ManufacturingData Processing ServicesRestaurantsInternet PublishingEnergy & UtilitiesInsurancePharmaceutical and Medicine ManufacturingCrop ProductionSpecialty Trade ContractorsPaper ManufacturingPlastics and Rubber Products ManufacturingPrimary Metal ManufacturingFabricated Metal Product ManufacturingWarehousing and StorageNursing and Residential Care FacilitiesSocial AssistancePerforming Arts, Spectator Sports, and Related IndustriesLoggingElectric Power Generation, Transmission and DistributionNonresidential Building ConstructionPlastics Product ManufacturingMotor Vehicle ManufacturingMotor Vehicle Parts ManufacturingAerospace Product and Parts ManufacturingShip and Boat BuildingMedical Equipment and Supplies ManufacturingLumber and Other Construction Materials Merchant WholesalersGrocery and Related Product Merchant WholesalersBuilding Material and Supplies DealersMotion Picture and Video IndustriesAutomotiveClothing StoresLegal ServicesSpecialized Design ServicesManagement, Scientific, and Technical Consulting ServicesScientific Research and Development ServicesRemediation and Other Waste Management ServicesElementary and Secondary SchoolsColleges, Universities, and Professional SchoolsBusiness Schools and Computer and Management TrainingTechnical and Trade SchoolsEducational Support ServicesOffices of PhysiciansOffices of DentistsOutpatient Care CentersMedical and Diagnostic LaboratoriesHome Health Care ServicesIndividual and Family ServicesAll Other Animal ProductionPerforming Arts CompaniesSpectator SportsPromoters of Performing Arts, Sports, and Similar EventsIndependent Artists, Writers, and PerformersMuseums, Historical Sites, and Similar InstitutionsOther Amusement and Recreation IndustriesRestaurants and Other Eating PlacesPersonal Care ServicesOther Personal ServicesReligious OrganizationsGrantmaking and Giving ServicesCivic and Social OrganizationsBusiness, Professional, Labor, Political, and Similar OrganizationsExecutive, Legislative, and Other General Government SupportJustice, Public Order, and Safety ActivitiesAdministration of Human Resource ProgramsAdministration of Economic ProgramsNational Security and International AffairsDairy Cattle and Milk ProductionElectric Power GenerationElectric Power Transmission, Control, and DistributionPlumbing, Heating, and Air-Conditioning ContractorsAnimal Slaughtering and ProcessingPaper Bag and Coated and Treated Paper ManufacturingPrintingToilet Preparation ManufacturingCoating, Engraving, Heat Treating, and Allied ActivitiesCommercial and Service Industry Machinery ManufacturingMetalworking Machinery ManufacturingEngine, Turbine, and Power Transmission Equipment ManufacturingTelephone Apparatus ManufacturingAudio and Video Equipment ManufacturingSemiconductor and Other Electronic Component ManufacturingAutomobile and Other Motor Vehicle Merchant WholesalersFurniture Merchant WholesalersOther Chemical and Allied Products Merchant WholesalersWine and Distilled Alcoholic Beverage Merchant WholesalersBusiness to Business Electronic MarketsNew Car DealersFurniture StoresElectronics and Appliance StoresSupermarkets and Other Grocery (except Convenience) StoresPharmacies and Drug StoresFamily Clothing StoresJewelry StoresSporting Goods StoresGeneral Merchandise Stores, including Warehouse Clubs and SupercentersOffice Supplies and Stationery StoresFreight Transportation ArrangementGeneral Warehousing and StorageNewspaper PublishersPeriodical PublishersBook PublishersMotion Picture and Video ProductionWired and Wireless Telecommunications CarriersData Processing, Hosting, and Related ServicesLibraries and ArchivesAll Other Information ServicesMortgage and Nonmortgage Loan BrokersInvestment Banking and Securities DealingMiscellaneous IntermediationPortfolio ManagementGeneral Rental CentersOffice Machinery and Equipment Rental and LeasingEngineering ServicesIndustrial Design ServicesGraphic Design ServicesComputer Systems Design and Related ServicesManagement Consulting ServicesEnvironmental Consulting ServicesResearch and Development in the Social Sciences and HumanitiesAdvertising AgenciesPublic Relations AgenciesPhotographic ServicesTranslation and Interpretation ServicesVeterinary ServicesManagement of Companies and EnterprisesFacilities Support ServicesEmployment Placement Agencies and Executive Search ServicesTelephone Call CentersInvestigation, Guard, and Armored Car ServicesConvention and Trade Show OrganizersPublishing ServicesJustice & Safety ActivitiesAccommodation&Food ServicesChemical&Pharmaceutical ManufacturingMiningTruck&Rail TransportationCivic&Social OrganizationsTelecommunicationsTransportation&WarehousingRetailAgriculture&ForestryElectrical&Electronical ManufacturingSea TransportationInformation ServicesComputer Design & ServicesBankingOtherFinanceBettingProfessional&Technical ServicesHealthCare & Social AssistanceArts & EntertainmentRental & LeasingAdministrative & Support ServicesArchitectural ServicesCouriers and Express Delivery ServicesHuman Resources Consulting ServicesIndustrial Machinery and Equipment Merchant WholesalersLandscaping ServicesOffices of Certified Public AccountantsOffices of LawyersScenic and Sightseeing Transportation, LandSecurity Guards and Patrol ServicesSecurity Systems Services (except Locksmiths)Ship Building and RepairingSporting and Athletic Goods ManufacturingTour OperatorsTravel AgenciesComputer Systems Design Services

Associated Activity¹

Initial Access: Exploitation of vulnerabilities in Fortinet firewalls (CVE-2024-21762, CVE-2024-55591) or VPN platforms (CVE-2026-50751).Initial Access: Suspicious connections from compromised RDP or VPN credentials.Execution: Use of PsExec for remote execution or SSH for propagation within the network.Defense Evasion: Attempts to disable security software, EDR, or clear Windows Event logs using vulnerable drivers (BYOVD).Defense Evasion: Deletion of Volume Shadow Copies (VSS) to hinder system recovery.Defense Evasion: Deployment of Linux encryptors through Windows Subsystem for Linux (WSL).Persistence: Malware deleting itself after execution to obstruct forensic analysis.Lateral Movement: Use of Remote Monitoring and Management (RMM) tools like Cobalt Strike, WinSCP, or Splashtop for internal movement.Credential Access: Execution of Mimikatz or LSASS memory dumps for credential theft.Collection: Packaging of sensitive data using tools like 7-Zip prior to exfiltration.Impact: Presence of ransomware notes in infected directories, often with customized company IDs as encrypted file extensions.Impact: Files encrypted with algorithms such as ChaCha20, AES-256, or RSA4096.Execution: Use of loaders like SmokeLoader or NETXLOADER to stage ransomware payloads.

ATT&CK IDs¹

T1486T1490T1078T1071.001T1059.001

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
qilin Ransomware / Extortion Operations⁶	qilin Ransomware / Extortion Operations is retained in the campaign database for qilin. Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Indicators

IOCs And Observable Retention

SOCRadar reported 2895²IntelliOS retained 37^5,3,4

SOCRadar reports 2895 IOCs for this profile. IntelliOS currently retains 37 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 4 source groups tracked; 3 currently contribute retained observable or context rows.

Retained Observables

Showing 37 of 37

Type	Value	Source
SHA-256 Hash	0b9b0715a1ffb427a02e61ae8fd11c00b5d086eb76102d4b12634e57285c1aba³	SophosLabs IoCs
SHA-256 Hash	12fcde06ddadf1b48a61b12596e6286316fd33e850687fe4153dfd9383f0a4a0⁴	Cisco Talos
SHA-256 Hash	16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0⁴	Cisco Talos
SHA-256 Hash	45c8716c69f56e26c98369e626e0b47d7ea5e15d3fb3d97f0d5b6e8997299d1a³	SophosLabs IoCs
SHA-256 Hash	7787da25451f5538766240f4a8a2846d0a589c59391e15f188aa077e8b888497⁴	Cisco Talos
SHA-256 Hash	9da70c521b929725774c3980763a4aed9baf9de4e6f83fc8f668c3a365a55f82³	SophosLabs IoCs
SHA-256 Hash	b52917b0658cd2a9197e6bb62bade243ee1ad164f2bb566f3a1e09dfa580397f³	SophosLabs IoCs
SHA-256 Hash	bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56⁴	Cisco Talos
SHA-256 Hash	ef3e42e5fa24acaee2428ff0118feb2be925bfe6b1ea4eccce8b70a7ac5ab2cc³	SophosLabs IoCs
SHA-256 Hash	fdf6b0560385a6445bd399eba03c8662be9e61928d6cbc268d550163a5a09285³	SophosLabs IoCs
SHA-1 Hash	01d00d3dd8bc8fd92dae9e04d0f076cb3158dc9c⁴	Cisco Talos
SHA-1 Hash	82ed942a52cdcf120a8919730e00ba37619661a3⁴	Cisco Talos
SHA-1 Hash	84e2d2084fe08262c2c378a377963a1482b35ac5⁴	Cisco Talos
SHA-1 Hash	ce1b9909cef820e5281618a7a0099a27a70643dc⁴	Cisco Talos
MD5 Hash	1305e8b0f9c459d5ed85e7e474fbebb1⁴	Cisco Talos
MD5 Hash	6bc8e3505d9f51368ddf323acb6abc49⁴	Cisco Talos
MD5 Hash	89ee7235906f7d12737679860264feaf⁴	Cisco Talos
MD5 Hash	cf7cad39407d8cd93135be42b6bd258f⁴	Cisco Talos
Import Hash	05aa031a007e2f51e3f48ae2ed1e1fcb⁴	Cisco Talos
TLSH	T1B4647C01B7E50CF9EE77C638C9614A06EA72BC425761DADF43A04A964F237D09E3DB12⁴	Cisco Talos
Filename	EDRKiller.exe⁴	Cisco Talos
Filename	hlpdrv.sys⁴	Cisco Talos
Filename	msimg32.dll⁴	Cisco Talos
Filename	rwdrv.sys⁴	Cisco Talos
File Path	C:\programdata\veeam.exe³	SophosLabs IoCs
File Path	C:\README-RECOVER-<victim ID> .txt³	SophosLabs IoCs
File Path	C:\Users\<username>\Documents\<MSPname>.exe³	SophosLabs IoCs
File Path	C:\Windows\SystemTemp\ScreenConnect\24.3.7.9067\ru.msi³	SophosLabs IoCs
Network Indicator	cloud.screenconnect.com.ms³	SophosLabs IoCs
Network Indicator	hxxps[:]//b8dymnk3.r.us-east-1.awstrack[.]me/L0/https[:]%2F%2Fcloud.screenconnect[.]com.ms%2FsuKcHZYV/1/010001948f5ca748-c4d2fc4f-aa9e-40d4-afe9-bbe0036bc608-000000/mWU0NBS5qVoIVdXUd4HdKWrsBSI=410³	SophosLabs IoCs
Network Indicator	hxxps[:]//cloud.screenconnect[.]com.ms/suKcHZYV/1/010001948f5ca748-c4d2fc4f-aa9e-40d4-afe9-bbe0036bc608-000000/mWU0NBS5qVoIVdXUd4HdKWrsBSI=410³	SophosLabs IoCs
Network Indicator	109.107.173.60³	SophosLabs IoCs
Network Indicator	109.70.100.1³	SophosLabs IoCs
Network Indicator	128.127.180.156³	SophosLabs IoCs
Network Indicator	186.2.163.10³	SophosLabs IoCs
Network Indicator	92.119.159.30³	SophosLabs IoCs
Campaign Context	Thin Qilin row backfilled from the same SophosLabs, Cisco Talos, and SentinelOne source set as the SOCRadar Qilin card; IntelliOS retains duplicate-card boundaries for reader interpretation.⁵	SentinelOne

Source	Reported	Retained	Coverage Status
SOCRadar²	2895	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
SentinelOne⁵	N/A	1	Public filenames, paths, tool, or infrastructure observables retained and displayed.
SophosLabs³	N/A	18	Public observables or source-context rows retained and displayed.
Cisco Talos⁴	N/A	18	Public observables or source-context rows retained and displayed.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Qilin	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Qilin	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Qilin.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Threat actor directory source for profile fields and reported activity.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/qilin	Actor-specific source for ransomware profile metadata and reported IOC counts when available.
3	SophosLabs IoCs: Ransomware-Qilin-STAC4365 https://raw.githubusercontent.com/sophoslabs/IoCs/master/Ransomware-Qilin-STAC4365.csv	IOC Source
4	Cisco Talos: Qilin EDR killer infection chain https://blog.talosintelligence.com/qilin-edr-killer/	IOC Source
5	SentinelOne: Agenda/Qilin ransomware profile https://www.sentinelone.com/anthology/agenda-qilin/	Threat Actor Profile
6	qilin - Ransomware.live group profile https://www.ransomware.live/group/qilin	Ransomware.live campaign row source for qilin Ransomware / Extortion Operations.

Loading Threat Actor Cards

Qilin

Top 10 Talking Points

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.1

Double extortion is central to Qilin's leverage.1,2

Initial access commonly combines identity and edge exposure.1,2

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.1,2

Windows, Linux, and VMware ESXi environments can all be affected.1,2

Legitimate tools help Qilin blend into normal administration.1,2

Qilin deliberately attacks security controls before encryption.1,2

Recovery infrastructure is part of the target set.1,2

Qilin's victimology is broad and commercially opportunistic.1,2

Successful recovery must address both business interruption and stolen data.1,2

BLUF

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.1

Double extortion is central to Qilin's leverage.1,2

Initial access commonly combines identity and edge exposure.1,2

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.1,2

Windows, Linux, and VMware ESXi environments can all be affected.1,2

Legitimate tools help Qilin blend into normal administration.1,2

Qilin deliberately attacks security controls before encryption.1,2

Recovery infrastructure is part of the target set.1,2

Qilin's victimology is broad and commercially opportunistic.1,2

Successful recovery must address both business interruption and stolen data.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.¹

Double extortion is central to Qilin's leverage.^1,2

Initial access commonly combines identity and edge exposure.^1,2

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.^1,2

Windows, Linux, and VMware ESXi environments can all be affected.^1,2

Legitimate tools help Qilin blend into normal administration.^1,2

Qilin deliberately attacks security controls before encryption.^1,2

Recovery infrastructure is part of the target set.^1,2

Qilin's victimology is broad and commercially opportunistic.^1,2

Successful recovery must address both business interruption and stolen data.^1,2

Qilin, formerly Agenda, is a mature Ransomware-as-a-Service operation.¹

Double extortion is central to Qilin's leverage.^1,2

Initial access commonly combines identity and edge exposure.^1,2

The pre-encryption phase is a hands-on-keyboard enterprise intrusion.^1,2

Windows, Linux, and VMware ESXi environments can all be affected.^1,2

Legitimate tools help Qilin blend into normal administration.^1,2

Qilin deliberately attacks security controls before encryption.^1,2

Recovery infrastructure is part of the target set.^1,2

Qilin's victimology is broad and commercially opportunistic.^1,2

Successful recovery must address both business interruption and stolen data.^1,2