Qilin (Agenda)

Russian-speaking ransomware-as-a-service behind the Synnovis attack, now claiming 900+ victims a year via stolen VPN logins, Fortinet and PAN-OS flaws and ESXi encryption.

Threat actor profile · Updated Nov 6, 2026

Active: July 2022 to October 2026
Origin: Russian-speaking (vendor assessment; no government attribution)
Type: Cybercrime
Affiliates: Water Galura (Trend Micro, MITRE G1050), Spikey Scorpius (Unit 42), Phantom Mantis (PRODAFT), Moonstone Sleet (North Korean user of the RaaS, per Microsoft), The Gentlemen, Securotrop (offshoots, per Acronis)
Regions targeted: United States, Canada, United Kingdom, France, Germany, Spain and Latin America, Japan, Asia, Africa, worldwide
MITRE ATT&CK: G1050

What each vendor calls it

Palo Alto Unit 42: Spikey Scorpius
Sophos / Secureworks: GOLD FEATHER
Trend Micro: Water Galura

Also known as AgendaPhantom Mantis PRODAFTQilin

See this actor in the Threat Actor Rosetta Stone →

Profile

Qilin is a ransomware-as-a-service operation that has grown from a minor player in 2022 into one of the busiest extortion brands in the world. It first appeared under the name Agenda: Halcyon dates its emergence to July 2022, and Trend Micro described the Go-based encryptor in August 2022, when it was hitting healthcare and education organizations in Asia and Africa. No government has formally attributed the operation to a country. Vendors describe it as Russian-speaking: a recruitment post Group-IB obtained says the program does not work in CIS countries, and Cisco Talos found scripts written in Cyrillic encoding, while cautioning that this could be a false flag. Trend Micro tracks the operators as Water Galura (MITRE ATT&CK G1050), Palo Alto Networks Unit 42 as Spikey Scorpius and PRODAFT as Phantom Mantis.

The business model is standard RaaS with generous terms. When Group-IB infiltrated the program in 2023, affiliates kept 80% of ransoms up to $3 million and 85% above that, and the panel let them build customized Windows and VMware ESXi encryptors. Every payload is tailored to its victim, with the company ID as the file extension and, in early versions, the victim’s own leaked credentials baked in. Encryptors now come in Rust for Windows, Linux and ESXi. Halcyon’s analysis of the Qilin.B variant in October 2024 found AES-256-CTR or ChaCha20 file encryption with RSA-4096-wrapped keys, shadow-copy deletion and event-log clearing.

Victim volume took off in 2024 and has not slowed. Talos counted more than 40 leak-site postings a month in the second half of 2025, with peaks near 100 in June and August, and Trend Micro put the total at more than 700 victims in 62 countries between January and October 2025. In October 2026 Acronis said the group had claimed more than 1,000 victims in 2025 and over 900 so far in 2026. These are the gang’s own leak-site claims, not confirmed breaches. Manufacturing is the most-hit sector in both Talos and Trend data, followed by professional services, technology, finance, wholesale and healthcare. The United States accounts for most claimed victims, then Canada, the UK, France and Germany.

Healthcare has felt it hardest. In June 2024 a Qilin attack hit Synnovis, the pathology provider for several London NHS hospitals. Synnovis confirmed ransomware; the gang published stolen patient data, and an outside analysis cited by Security Affairs estimated more than 900,000 people were in it. Acronis says healthcare makes up about 13% of the group’s identified victims.

Initial access is whatever the affiliate brings, but it clusters around remote access. Sophos described an intrusion through a VPN portal without MFA, after which the attackers edited Group Policy to harvest every user’s saved Chrome passwords at logon, T1555.003 (Credentials from Password Stores: Credentials from Web Browsers). Talos also points to leaked admin credentials used against VPNs, T1078 (Valid Accounts). Edge-device exploitation is a growing share, T1190 (Exploit Public-Facing Application): PRODAFT tied a mostly automated mid-2025 campaign to FortiGate flaws CVE-2024-21762 and CVE-2024-55591, and in October 2026 Unit 42 named Qilin among the ransomware crews abusing the PAN-OS GlobalProtect bypass CVE-2026-0257 to open VPN sessions without MFA, T1133 (External Remote Services). Trend Micro also saw fake CAPTCHA pages delivering infostealers whose stolen logins were later used for access.

Once inside, affiliates live off legitimate tools: AnyDesk, ScreenConnect, Splashtop and other RMM software, Cobalt Strike, SystemBC, Mimikatz, PsExec, and Cyberduck or WinRAR for exfiltration to cloud storage. Two tricks stand out. Trend Micro found affiliates running the Linux encryptor on Windows hosts, launched through Splashtop, to slip past Windows-focused EDR, alongside vulnerable-driver attacks that kill security tools and scripts that pull credentials out of Veeam backup databases. And the ESXi playbook has become a set routine: Acronis describes a PowerShell module that installs PowerCLI, resets ESXi root passwords, enables SSH and encrypts every host, so one compromised admin workstation can take out the whole virtual estate.

The brand has also become a platform others rent. Microsoft said in March 2025 that the North Korean state group it tracks as Moonstone Sleet had deployed Qilin in a limited number of attacks, the first time it had used someone else’s ransomware. Acronis reports that some affiliates have spun off their own brands, The Gentlemen and Securotrop, the latter still working inside Qilin’s network. Expect the name to stay prominent while affiliates keep finding unpatched VPNs.

Events

Date	Target	Narrative	Source	Our coverage
2026-10	Organizations worldwide, health care about 13% of identified victims	Acronis dissects a password-gated Rust encryptor and the embedded PowerShell routine that resets ESXi root passwords, enables SSH and encrypts every host. Acronis counts more than 900 claimed victims in 2026 and describes the offshoot brands The Gentlemen and Securotrop. Victim counts are leak-site claims.	Acronis	Our story
2026-10	Organizations running unpatched PAN-OS GlobalProtect, across education, finance, healthcare, manufacturing, government and other sectors	Unit 42 names Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) among ransomware operators abusing CVE-2026-0257 to open VPN sessions without MFA. In one intrusion the attackers pivoted to vCenter, disabled ESXi execInstalledOnly and dumped credentials offline from a domain controller’s virtual disk. Unit 42 does not tie specific sectors to each group.	Unit 42	Our story
2025-10	More than 700 victims in 62 countries since January 2025, mostly manufacturing, technology, financial services and healthcare	Trend Micro finds affiliates running the Linux encryptor on Windows hosts via WinSCP and Splashtop, vulnerable-driver attacks to disable security tools, and PowerShell that steals credentials from Veeam backup databases. Fake CAPTCHA pages delivered infostealers whose credentials were later used for access.	Trend Micro
2025-10	Manufacturing (about 23% of cases), professional and scientific services (18%), wholesale trade (10%), mainly in the US, Canada, UK, France and Germany	Talos reviews multiple Qilin incidents: leaked admin credentials used against VPNs without MFA, Group Policy changes to enable RDP, Mimikatz and NirSoft credential theft, Cyberduck exfiltration to cloud storage, and two encryptors, one spread by PsExec and one encrypting shares.	Cisco Talos
2025-09	Japanese brewer	The company confirmed a ransomware attack that suspended orders and shipments; Qilin later listed it on its leak site and claimed to have stolen about 27 GB of data. The data claim was not confirmed at the time.	Computer Weekly
2025-05 to 2025-06	Organizations with vulnerable FortiGate devices, with particular interest in Spanish-speaking countries	PRODAFT (which tracks the group as Phantom Mantis) assesses with moderate confidence that a partly automated campaign exploited FortiGate flaws including CVE-2024-21762 and CVE-2024-55591 for initial access.	BleepingComputer (citing PRODAFT)
2025-02	A limited number of organizations (not named)	Microsoft says the North Korean state actor Moonstone Sleet has been deploying Qilin ransomware since late February 2025, its first use of another operator’s ransomware.	BleepingComputer (citing Microsoft)
2024-10	Windows environments (victims not disclosed)	Halcyon documents Qilin.B: Rust encryptor with AES-256-CTR or ChaCha20 and RSA-4096 key wrapping, security-service termination, event-log clearing and shadow-copy deletion.	Halcyon
2024-07	Organization with a VPN portal lacking MFA	Sophos responders find Qilin operators added a logon Group Policy Object that harvested saved Chrome credentials from every user for more than three days, then used a second GPO to push the encryptor across the domain.	BleepingComputer (citing Sophos)
2024-06	Pathology provider for London NHS hospitals	Ransomware attack on Synnovis, which processes pathology tests for several London hospitals; Synnovis confirmed ransomware and Qilin published stolen patient data, estimated by an outside analysis at more than 900,000 people.	Security Affairs
2023-03 to 2023-05	Companies in critical sectors (12 leak-site victims by May 2023)	Group-IB infiltrates the affiliate program: 80 to 85% payouts, Windows and ESXi builders, and a ban on attacking CIS countries.	Group-IB
2022-12	Manufacturing and IT companies	Trend Micro reports the group has ported its encryptor to Rust, with intermittent encryption options and per-victim customization.	Trend Micro
2022-08	Healthcare and education organizations in Indonesia, Saudi Arabia, South Africa and Thailand	Trend Micro discloses Agenda, a Go ransomware tailored to each victim, with a safe-mode reboot option to dodge security tools and demands of $50,000 to $800,000.	Trend Micro

Target vectors risk profile

Ransomware/extortion	Manufacturing	Healthcare	Edge devices/VPNs	Technology/SaaS	Professional services	Finance	Retail/wholesale	Education/research	Government	Espionage
High	High	High	High	Medium	Medium	Medium	Medium	Medium	Low	N/A

Malware and tools

Name	What it does	Public detection	Hunt Leads	Reports
Qilin (Agenda) encryptor	Rust ransomware for Windows, Linux and ESXi; needs a password to run, kills services, deletes shadow copies, can spread to vCenter and ESXi hosts	ClamAV signature and Snort rule listed in Talos’s report	6 Hunt Leads	Acronis, Halcyon, MITRE ATT&CK
Agenda (Go variant)	Original 2022 Go encryptor with per-victim configuration and safe-mode reboot	Indicators in Trend Micro’s report		Trend Micro
Securotrop	Offshoot brand’s encryptor operating inside Qilin’s affiliate network	Hashes in Acronis’s report	6 Hunt Leads	Acronis
Cobalt Strike, SystemBC	Post-exploitation framework and SOCKS proxy backdoor used for command and control	ClamAV signatures listed in Talos’s report		Cisco Talos
Vulnerable-driver EDR killers	Tools loading signed but vulnerable drivers (eskle.sys, rwdrv.sys, hlpdrv.sys) to terminate security software	Indicators in Trend Micro’s report		Trend Micro
Mimikatz, NirSoft tools, Chrome credential script	Credential theft from memory, saved Windows and browser passwords; a GPO-pushed PowerShell script for Chrome logins	ClamAV Mimikatz signature listed in Talos’s report		Cisco Talos, BleepingComputer
AnyDesk, ScreenConnect, Splashtop, Cyberduck, PsExec	Legitimate remote access, file transfer and admin tools abused for control, exfiltration and lateral movement	None published specific to Qilin		Cisco Talos, Trend Micro

Reports

Date	Source	Report
2026-10-28	Acronis	Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion
2026-10-20	Unit 42	Active exploitation of May 2026 PAN-OS CVE-2026-0257
2025-10-26	Cisco Talos	Uncovering Qilin attack methods exposed through multiple cases
2025-10-23	Trend Micro	Agenda ransomware deploys Linux variant on Windows systems through remote management tools and BYOVD techniques
2025-06-06	BleepingComputer (citing PRODAFT)	Critical Fortinet flaws now exploited in Qilin ransomware attacks
2025-03-07	BleepingComputer (citing Microsoft)	Microsoft: North Korean hackers now deploying Qilin ransomware
2024-10-24	Halcyon	New Qilin.B ransomware variant boasts enhanced encryption and defense evasion
2024-08	BleepingComputer (citing Sophos)	Qilin ransomware now steals credentials from Chrome browsers
2023-05-15	Group-IB	The Qilin ransomware: analysis and protection strategies
2022-12-16	Trend Micro	Agenda ransomware uses Rust to target more vital industries
2022-08-25	Trend Micro	New Golang ransomware Agenda customizes attacks
Ongoing	MITRE ATT&CK	Qilin (S1242) and Water Galura (G1050)

Vulnerabilities exploited

Vulnerability	CVSS	Severity	Publisher	Platform	CISA KEV
CVE-2026-0257	9.1	Critical	Palo Alto Networks	PAN-OS GlobalProtect portal and gateway, Prisma Access	Yes
CVE-2024-55591	9.8	Critical	Fortinet	FortiOS and FortiProxy	Yes
CVE-2024-21762	9.8	Critical	Fortinet	FortiOS SSL VPN	Yes

If you’re in their sights

Do this now

Patch your firewalls and VPN gateways first, especially Palo Alto GlobalProtect (CVE-2026-0257) and FortiGate (CVE-2024-21762, CVE-2024-55591). Then search VPN logs back to the patch date for sessions you can’t explain.
Put phishing-resistant MFA on every VPN, remote desktop and admin login, and retire old or service accounts that can still log in remotely. Leaked passwords against MFA-free VPNs are this group’s most common way in.
Keep vCenter and ESXi management on their own network with separate credentials, enforce execInstalledOnly, and alert when ESXi SSH is enabled or root passwords change.
Protect backups: keep an offline or immutable copy, lock down the Veeam server and its database credentials, and test restores.
Alert on new or edited Group Policy Objects that run logon scripts, on remote access tools your IT team didn’t install, and on bulk uploads to cloud storage from servers.

Compiled from Trend Micro, Cisco Talos, Acronis, Unit 42, Halcyon, Group-IB, Sophos, PRODAFT and Microsoft research (some via BleepingComputer), MITRE ATT&CK and press reporting, plus ThreatRoundup reporting. Last reviewed November 1, 2026.