Inside Qilin: The Password-Locked Encryptor That Takes Down ESXi Too

Qilin, the ransomware operation that hit London hospital supplier Synnovis in 2024, claimed more than 1,000 victims in 2025 and over 900 so far this year, according to a new analysis from Acronis’s Threat Research Unit. Acronis took apart a recent Windows sample and the PowerShell routine it carries for encrypting VMware ESXi hosts, and describes an affiliate network that has started spinning off rival brands.

24a24c5fe9a5dc242b2908d020f890ed5b3afe8146fade4e3ab8a07d19007b6d
011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756
516927b55038c1702bc8a6a0262a39d5fe45f4b07527fdc42415533a9665264a
43672ef1384888922c13838f695da58f8cb9b8ad47ce896b3b7151e7edd18afb
bd1cf7823cabbac2ea7b45f2d7c9dfcd6b9a24714b6d40377bdef82b9c88021b
4f8efbfe1f94dc7c6d5547c836e56ed56b1b3c33d324bd8619b8108c572b5ca6
e81e9a3a8baca74a5c73bb5d0904cd7ac145e330c4d4993bfd671f3396402416
Securotrop e76fb9cf2da75e963e4d00b48500f59fa6a0e7d21915b8c54ca3d83c52b9d43b
Securotrop 62fd30a7841f36b389af9cf4b3230c666bf620d9f57eb3bf73a06fe86d0917ff

Source article: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion
Publisher: Acronis Threat Research Unit (authors: Darrel Virtusio, Eliad Kimhy)
Published: October 28, 2026
URL: https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/

Executive Summary

Qilin, also tracked as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that, according to Acronis TRU, claimed more than 1,000 victims in 2025 and more than 900 so far in 2026, gives affiliates up to 85% of each ransom, avoids CIS countries, and counts health care as about 13% of identified victims (including the 2024 Synnovis attack on London hospital services). Acronis links Qilin to Moonstone Sleet and to an alleged partnership with Scattered Spider, and describes two offshoots, The Gentlemen and Securotrop, the latter operating inside Qilin’s affiliate network with its own leak site; victim counts are the gang’s own leak-site claims. Affiliates get in through targeted phishing, stolen VPN and RDP credentials, vulnerable internet-facing applications (no CVEs named) and abused remote-management tools, then use legitimate admin tools to move laterally, escalate, disable security and recovery, and steal data before encrypting. The Windows payload Acronis analyzed is a 4.69 MB Rust-built PE32 that exits unless launched with a -password value whose SHA-256 matches a hardcoded hash (the same value is used as its mutex), and takes flags controlling scope, process and service killing, VM handling, safe-mode execution, spreading (fspread, spread-vcenter) and artifacts. Before encrypting it checks for a hypervisor, enables debug and impersonation privileges, stops processes and services on its blocklists (Hyper-V, SQL, Exchange, Veeam, Acronis, Sophos, Backup Exec, SAP and others), deletes shadow copies with vssadmin, turns on remote symlink evaluation with fsutil, sets EnableLinkedConnections, enumerates shares with net use, and adds a randomly named HKCU Run value. Files are encrypted with AES-CTR or ChaCha20 under per-file keys wrapped with RSA-4096, renamed with the victim’s company ID as the extension, and a README-RECOVER-<company-id>.txt note is dropped; per-thread logs go to %TEMP%\QLOG and are zipped to QLOGS.zip. When told to hit virtual machines, an embedded PowerShell routine installs PowerCLI, disables cluster services, enumerates ESXi hosts, changes their passwords, enables SSH and uploads and runs the encryptor on each one. The objective is double extortion, and the impact is encryption of Windows servers and every VM on reachable ESXi hosts plus publication of stolen data. Hunt leads, false-positive expectations and indicators are detailed below; Acronis published no YARA or Sigma rules.

ATT&CK chain: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Discovery → Lateral Movement → Impact

Hunt Lead Grid

Qilin Encryptor Artifacts and Hash Sweep

Acronis documents several artifacts the Windows encryptor always leaves unless the affiliate suppresses them. It logs to the console, then writes one .txt log per worker thread under %LOCALAPPDATA%\Temp\QLOG (OTX sandbox output for one sample shows names such as ThreadId(1).LOG), and archives them into QLOGS.zip after encryption so the affiliate can take them. Each encrypted folder gets a note named README-RECOVER-<company-id>.txt, and encrypted files take the victim’s company ID as the extension; in the analyzed sample that ID is 3Tqc380bbh, but it changes per victim. The mutex is 6595b1d7bf87cd3360d08afc1a24e32bca28620ddb4f2131ddf242cc1e4f97e2, the same value as the SHA-256 of the launch password, so it is sample-specific too. The detection logic is a file and mutex sweep for the QLOG directory, QLOGS.zip, any file matching *README-RECOVER-*.txt, any extension equal to a ten-character mixed-case string appearing on hundreds of files at once, and the published SHA-256 values for the seven Qilin and four Securotrop samples in the appendix.

Use EDR file-creation and mutex telemetry, file-integrity or file-server auditing for the notes and extension changes, and a retrospective hash search across EDR and any sandbox or malware repository. Sweep back 90 days, since Qilin affiliates often dwell before encrypting and test runs (the dry-run flag) can precede the real one. Scope is all Windows servers and workstations, with file servers and hypervisor management hosts first. Treat the hashes as retrospective indicators only; each affiliate build differs, so the folder, note and zip names last longer. Blocking the onion leak-site addresses Acronis lists is not useful and they are omitted here under our policy on leak sites. Any hit on QLOG or a note is an active incident: isolate the host, preserve QLOGS.zip if present because it records what was encrypted, and check the ESXi lead below for the same time window.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Impact → T1486 (Data Encrypted for Impact); Collection → T1074.001 (Data Staged: Local Data Staging) for the zipped logs. Acronis publishes no ATT&CK mapping; these are assigned from the behavior it describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article); AlienVault OTX file analysis for 011dcd84…1756, retrieved Oct. 29, 2026, https://otx.alienvault.com/indicator/file/011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756 (additional source; QLOG file names from sandbox output)

Encryptor Launched With -password and Qilin Control Flags

The encryptor will not run without -password: it hashes the value with SHA-256, compares it to a hardcoded hash, and exits on a mismatch, which makes sandboxes that run it bare see nothing. The operator passes the password on the command line together with flags from a long, distinctive set Acronis lists: no-escalate, impersonate, safe, no-priority, no-admin, forced, debug, dry-run; scope flags no-local, no-mounted, no-domain, no-network; filter flags no-ef, no-ff, no-df; handling flags no-proc, no-services, no-vm, kill-cluster; artifact flags no-extension, no-wallpaper, no-note, no-destruct, no-zero, no-logs, logs, print-image, print-delay; spreading flags fspread and spread-vcenter; and no-autostart. With impersonate it duplicates another process’s token and sets it on its thread. The detection logic is a process-creation rule for a command line containing -password plus at least one of these flag names, launched from an unsigned executable in a user-writable or share path, with highest severity for spread-vcenter, fspread, kill-cluster or safe.

Use EDR or Sysmon process-creation events (event ID 1) or Windows Security event ID 4688 with command-line auditing enabled, across all Windows hosts. Because the password is in clear text on the command line, a hit also gives responders the value needed to detonate the sample. Allowlist nothing by process name, since affiliates rename the binary freely; anchor on the flag combination and the image path or signature instead. Hash-based blocking alone is the wrong control because every affiliate build has new hashes. Any hit is an active ransomware deployment and should go straight to incident response for containment, not tuning; if spread-vcenter is present, immediately check vCenter for the ESXi lead below. The flag-combination approach also catches renamed or repacked Qilin builds that keep the same argument parser.

Hunt Lead Level: 2 (Pro)

ATT&CK: Impact → T1486 (Data Encrypted for Impact); the impersonate option is T1134.001 (Access Token Manipulation: Token Impersonation/Theft). Assigned from the behavior Acronis describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article)

Random Six-Letter HKCU Run Value With Arguments

Unless launched with no-autostart, the encryptor writes a value under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run whose name is six random letters, regenerated on every run, and whose data is the payload’s path followed by its arguments, so it relaunches at logon with the same password and flags. The detection logic is a registry rule for new values under that key where the name is exactly six alphabetic characters with no recognizable vendor string, and the data points to an executable outside Program Files and Windows (temp folders, user profiles, ProgramData, network shares) or contains -password.

Use EDR registry telemetry or Sysmon event IDs 12 to 14, plus an autoruns-style inventory for the retrospective sweep across all user hives, going back 90 days. Allowlist legitimate updaters by the signer and path of the target binary, not by value name, since many vendors use short value names. Deleting the Run value is not remediation; it only removes the relaunch, so the host still needs full ransomware response. A hit whose data contains -password is conclusive and should be escalated immediately; other hits need the target binary pulled and checked against the hash list and the command-line lead. Short random Run-key names pointing at user-writable paths are a common pattern in other ransomware and loaders too.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence / Privilege Escalation → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Assigned from the behavior Acronis describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article)

Shadow Copy Deletion With Remote Symlink and Linked-Connection Changes

During preparation the encryptor runs vssadmin.exe delete shadows /all /quiet, then fsutil behavior set SymlinkEvaluation R2R:1 and fsutil behavior set SymlinkEvaluation R2L:1 so it can follow remote-to-remote and remote-to-local symbolic links on shares, sets EnableLinkedConnections under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System so mapped drives are visible to the elevated process, and runs net use to list mapped drives and network connections. It also disables WOW64 file-system redirection around encryption. The detection logic is a process rule on any one of vssadmin delete shadows, fsutil behavior set SymlinkEvaluation with R2R:1 or R2L:1, or a registry write of EnableLinkedConnections, raised to high severity when two or more occur from the same parent process (or the same unsigned image) within ten minutes, and to critical when net use follows.

Use EDR process and registry telemetry, Sysmon event IDs 1 and 13, or Security event ID 4688 with command lines, on all Windows servers and workstations; sweep 90 days to find dry runs or earlier attempts. Some backup tools do delete shadow copies, so allowlist those by signed image path and parent rather than by command line, and keep alerting on the fsutil symlink change, which legitimate software rarely makes. Blocking vssadmin outright is a valid hardening step on endpoints but can break backup products on servers; protecting backups so the host cannot delete them is the stronger control, as Acronis recommends. A clustered hit is pre-encryption activity: isolate the host immediately rather than investigate in place. This combination is shared by several ransomware families, so the lead generalizes beyond Qilin.

Hunt Lead Level: 2 (Pro)

ATT&CK: Impact → T1490 (Inhibit System Recovery); Defense Evasion → T1112 (Modify Registry); Discovery → T1135 (Network Share Discovery). The fsutil symlink change is not mapped to a specific technique (insufficient fit). Assigned from the behavior Acronis describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article)

Mass Stop of Backup, Database and Security Services Before Encryption

On a separate thread the encryptor enumerates processes with CreateToolhelp32Snapshot and terminates any outside its allow logic, and stops services with ControlService(SERVICE_CONTROL_STOP) against a blocklist that includes Hyper-V (vmms, vmwp, vmcompute), Volume Shadow Copy, anything matching the regex (.*?)sql(.*?), Exchange, Sophos, Backup Exec, SAP, Acronis and Veeam, as well as Office applications, databases and remote-access tools such as TeamViewer. Encryption then runs across local, mounted and network drives with a worker pool sized to the CPU count, renaming every file with the company-ID extension. The detection logic is a stateful count: one non-system process (not services.exe, an installer or a patch agent) stopping five or more distinct services from those categories within a few minutes, joined on the same host to a spike in file renames or writes to a single new extension, or to the creation of README-RECOVER-*.txt files.

This needs service-control telemetry (System event ID 7036 shows state changes but not the caller, so EDR attribution of the stopping process is preferred), process termination events, and high-volume file-rename telemetry, joined per host in a SIEM or EDR correlation rule with a five-to-fifteen-minute window. Baseline maintenance windows and patch tooling first and suppress by signed parent and schedule, not by service name. File-server auditing catches the rename burst even when the encryptor runs on a remote host against shares. Blocking service stops globally is not practical, but tamper protection on backup and security agents is. A correlated hit means encryption is under way: isolate the host and the file servers it touches, and disable the account it runs under. Service-stop bursts before mass renaming are common to most ransomware, so the rule generalizes well.

Hunt Lead Level: 3 (Elite)

ATT&CK: Impact → T1489 (Service Stop), T1486 (Data Encrypted for Impact). Assigned from the behavior Acronis describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article)

PowerCLI From a Windows Host Resetting ESXi Passwords and Enabling SSH

When VM targeting is enabled (the spread-vcenter flag), the encryptor saves and runs a PowerShell script that installs .NET Framework and the NuGet provider if missing, installs and reconfigures VMware PowerCLI, disables cluster services, enumerates the ESXi hosts managed by vCenter, changes their passwords, enables SSH, changes host configuration, and uploads and runs the encryptor on each host. Acronis does not name the individual cmdlets or esxcli commands. The point is that a single compromised Windows host with vCenter credentials is enough to encrypt every VM. The detection logic is a two-sided correlation: on Windows, a PowerShell process (parented by an unsigned executable or launched from a temp path) installing the NuGet provider or PowerCLI modules and opening connections to vCenter; on vCenter and ESXi, within the following minutes, password changes for host accounts, SSH being enabled on several hosts, cluster services (such as HA or DRS) being disabled, and new files appearing in host datastores or /tmp followed by execution.

Use PowerShell script-block logging (event ID 4104) and module logging, EDR process and network telemetry for the Windows side, and vCenter events plus ESXi syslog (hostd, auth, shell logs) forwarded off the hosts for the vSphere side; join them in a SIEM on time and vCenter source IP. Scope the Windows side to every server, not just VMware admin workstations, because Qilin runs this from whatever host it lands on. Allowlist the specific jump hosts and service accounts that legitimately run PowerCLI, and still alert when they change root passwords on multiple hosts outside change windows. Enabling ESXi lockdown mode, keeping SSH disabled by default with alerts on enablement, and isolating the vSphere management network are the right controls; relying on ESXi host antivirus is not. Any hit is a top-priority incident: disconnect the source Windows host, reset vCenter and ESXi credentials from a clean system, and check every host’s SSH state. Ransomware groups commonly target ESXi through vCenter in this way, so the lead generalizes.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1059.001 (Command and Scripting Interpreter: PowerShell); Persistence / Privilege Escalation → T1098 (Account Manipulation); Lateral Movement → T1021.004 (Remote Services: SSH). Assigned from the behavior Acronis describes.

Sources: “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis TRU, Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article)

Hash Appendix

Qilin Windows encryptor

The 64-character values come from the source article, which does not label the algorithm; they match SHA-256 file records in AlienVault OTX. MD5 and SHA-1 were sourced via OTX where its analysis had them; OTX has no analysis for e81e9a3a…2416; VirusTotal was not queried. OTX’s static analysis of these samples also shows an embedded PsExec debug path, consistent with the encryptor’s spreading options.

MD5s

38df25c00eaa64e15523f54ecb8b70c5  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
40cbef44d0ac78fae7c23803b0873cbe  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
dcaac89539ff0f6313d8a48ce72a1e07  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
110709baefee24f6d2e766c236312acb  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
ef2e75f7e2d6ace02ab61cb6e8c79bcd  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
6a051dcfaa8308563535490b74f43345  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
(not available)  # Qilin Windows encryptor, SHA-256 e81e9a3a...2416

SHA1s

40391ffa9cd237470978cadb9a7c2c26963e9897  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
b31585878977c3f36718c50d1eb85e7d872ba13e  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
de5e2c06fc430da77cb7ee8db936c3664d5ef6bd  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
1eefa4bdab2ddc048478b49da2ed24a247ab1f2f  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
bb7962e38b348d9f7a9f6f96bbd62c37d490b296  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
ba7465a267877695061272a28b6091c0ea47d49e  # Qilin Windows encryptor (Rust PE32) (sourced via OTX)
(not available)  # Qilin Windows encryptor, SHA-256 e81e9a3a...2416

SHA256s

24a24c5fe9a5dc242b2908d020f890ed5b3afe8146fade4e3ab8a07d19007b6d  # Qilin Windows encryptor (Rust PE32)
011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756  # Qilin Windows encryptor (Rust PE32)
516927b55038c1702bc8a6a0262a39d5fe45f4b07527fdc42415533a9665264a  # Qilin Windows encryptor (Rust PE32)
43672ef1384888922c13838f695da58f8cb9b8ad47ce896b3b7151e7edd18afb  # Qilin Windows encryptor (Rust PE32)
bd1cf7823cabbac2ea7b45f2d7c9dfcd6b9a24714b6d40377bdef82b9c88021b  # Qilin Windows encryptor (Rust PE32)
4f8efbfe1f94dc7c6d5547c836e56ed56b1b3c33d324bd8619b8108c572b5ca6  # Qilin Windows encryptor (Rust PE32)
e81e9a3a8baca74a5c73bb5d0904cd7ac145e330c4d4993bfd671f3396402416  # Qilin Windows encryptor (Rust PE32)

Securotrop Windows encryptor

The 64-character values come from the source article (algorithm unlabeled; they match SHA-256 records in OTX). MD5 and SHA-1 were sourced via OTX for three samples; no MD5 or SHA-1 was retrieved for 61820172…4104; VirusTotal was not queried.

MD5s

551105de80b2dfce19da4ceab42251ae  # Securotrop Windows encryptor (sourced via OTX)
2c36a2a36a747ee8e1393724c2558b14  # Securotrop Windows encryptor (sourced via OTX)
(not available)  # Securotrop Windows encryptor, SHA-256 61820172...4104
46e93e58515ff20bd9c68d26e549266b  # Securotrop Windows encryptor (sourced via OTX)

SHA1s

82a8aa7ec5181a26b54c6c5f58dd2e78215c1fb6  # Securotrop Windows encryptor (sourced via OTX)
0e493032f66b499abb2edc978b372d1c8a444c10  # Securotrop Windows encryptor (sourced via OTX)
(not available)  # Securotrop Windows encryptor, SHA-256 61820172...4104
eafb62e276b171d35df939ee443f1cd922bda41b  # Securotrop Windows encryptor (sourced via OTX)

SHA256s

e76fb9cf2da75e963e4d00b48500f59fa6a0e7d21915b8c54ca3d83c52b9d43b  # Securotrop Windows encryptor
62fd30a7841f36b389af9cf4b3230c666bf620d9f57eb3bf73a06fe86d0917ff  # Securotrop Windows encryptor
61820172ff5440c9e4f48695cc3551638306d06214cf72df41740dd08d734104  # Securotrop Windows encryptor
54f36b39e5bcee15acc530d70c173f26a1e1d7a62e866181d8a68309b4660928  # Securotrop Windows encryptor

References Appendix

• “Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion”, Acronis Threat Research Unit (Darrel Virtusio, Eliad Kimhy), Oct. 28, 2026, https://www.acronis.com/en/tru/posts/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion/ (source article; encryptor analysis, ESXi routine, hashes)
• AlienVault OTX file analyses for the Qilin and Securotrop SHA-256 values above, retrieved Oct. 29, 2026, e.g. https://otx.alienvault.com/indicator/file/011dcd84bc7b8faa8c32020f3530be599d213888c0e8b750b95595f8ff331756 (MD5/SHA-1 values, QLOG file names from sandbox output)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/