Overview
Qilin, also known as Agenda, is a highly sophisticated ransomware-as-a-service (RaaS) operation active since at least 2022. The group distinguishes itself through extensive customization options for affiliates and a focus on double extortion. Qilin encrypts victim data and also exfiltrates files; if ransom is not paid, stolen data is leaked publicly.
Attribution & Origin
- Aliases: Agenda
- First observed: 2022
- Model: Ransomware-as-a-Service (RaaS)
- Primary target countries: United States, United Kingdom, Germany, France, Canada, Japan
- Primary target sectors: Critical infrastructure including healthcare, manufacturing, and education
Notable Characteristics
Double extortion
Encrypts and exfiltrates data; leaks if unpaid.
Customization
Affiliates configure persistence, encryption, and execution behavior.
Sophistication
Uses layered persistence, privilege escalation, and evasion.
Initial access
Frequently via credentials purchased or leaked on underground markets.
Tactics, Techniques & Procedures (MITRE ATT&CK)
Initial Access
- Valid Accounts (T1078): Access via leaked or purchased credentials.
- Spearphishing Link (T1566.002): Malicious links/attachments in email.
Execution
- Command and Scripting Interpreter (T1059): Use of CLI and scripts to execute actions.
Persistence
- Scheduled Task (T1053.005): Maintains persistence through scheduled tasks.
- Registry Run Keys / Startup Folder (T1547.001): Registry entries or startup executables.
- Valid Accounts (T1078): Continued access using compromised accounts.
Privilege Escalation
- Process Injection (T1055): Code injection into legitimate processes.
- Group Policy Modification (T1484.001): Weakens security settings via GPO changes.
- Group Policy Preferences (T1552.006): Abuse of stored credentials.
Defense Evasion
- Disable Windows Event Logging (T1562.002): Hinders detection and analysis.
- Safe Mode Boot (T1562.009): Reboots into Safe Mode before encryption.
- Modify Registry (T1112): Adjusts registry settings to avoid detection.
Credential Access
- Credentials in Files (T1552.001): Searches for and extracts credentials from files.
Lateral Movement
- Replication Through Removable Media (T1091): Spreads via removable devices.
Evasion & Anti-Forensics
- Disables security systems prior to encryption.
- Disables Windows Event Logs to obscure activity.
- Boots into Safe Mode to neutralize protections before encrypting data.
Defensive Recommendations
- Multi-Factor Authentication (MFA): enforce for all remote and privileged accounts.
- Network segmentation: isolate critical systems and reduce blast radius.
- Patch management: prioritize external-facing services.
- Endpoint Detection & Response (EDR): monitor for persistence and credential-theft behavior.
- User awareness training: phishing and credential-theft education.
- Backups: maintain offline, tested backups.
References
- MITRE ATT&CK. Qilin Ransomware — Techniques and Procedures. attack.mitre.org
- Cyble. Qilin Ransomware Group — Threat Actor Profile. cyble.com
- U.S. Department of Health & Human Services. Qilin Threat Profile (TLP:CLEAR). hhs.gov