Latest Qilin Ransomware IOCs Analysis Emerging Threat Indicators
Profile of 2025’s Most Active Extortion Operation Qilin (formerly Agenda) is a Rust-based ransomware-as-a-service operation that became the most active extortion brand of 2025 – absorbing displaced affiliates after RansomHub’s collapse, running double…
- Ransomware
- Qilin
Bottom line. Qilin is currently the highest-volume ransomware operation and a top threat to enterprise and public-sector networks. Because it is a RaaS run by many affiliates, defenders should prioritise the common intrusion path – phished/abused remote access, credential theft, and rapid lateral movement – rather than any single indicator. The two indicators reviewed below are provisional leads, not confirmed Qilin infrastructure.
Background
Qilin launched in 2022 as ‘Agenda’, later rebranding and rewriting its encryptor in Rust (with C variants) to become a mature ransomware-as-a-service platform. Operators maintain the payload, affiliate panels and leak site while affiliates – who earn roughly 80-85% of each ransom – carry out intrusions. Recruitment runs through the Russian-language cybercrime forum RAMP.
In 2025 Qilin became the most active ransomware operation tracked, surpassing LockBit’s peak. After RansomHub went dark in April 2025, many of its affiliates migrated to Qilin, and in Q2 2025 Qilin became the top ransomware threat to US state, local, tribal and territorial governments. Public reporting counts on the order of a thousand-plus leak-site victims for 2025, concentrated in manufacturing, professional services, retail/hospitality and technology.
Qilin runs classic double extortion – stealing data before encrypting and threatening to leak it on a Tor and clearnet leak site. Its affiliate base is broad and dangerous: Scattered Spider / Octo Tempest became a Qilin affiliate in 2024, and Microsoft reported the North Korean actor Moonstone Sleet deploying Qilin in 2025.
What we observed
Qilin affiliate intrusions follow a recognisable hands-on-keyboard pattern before encryption:
- Initial access: affiliates favour phishing, exploitation of public-facing applications, and external remote services (RDP, VPN). One April 2025 case phished ScreenConnect administrator credentials from an MSP to reach downstream customers.
- Post-exploitation: reported tooling includes Cobalt Strike, SmokeLoader and a .NET loader (NETXLOADER) for staging, with PsExec, NetExec and WinRM used for lateral movement.
- Credential theft and evasion: affiliates have been observed stealing Google Chrome credentials before encryption, harvesting VPN credentials for persistence, and abusing Windows Subsystem for Linux (WSL) to run payloads outside the view of some EDR tools.
- Exfiltration and encryption: files are collected and staged (e.g. with WinRAR) and exfiltrated to services such as
easyupload[.]io, followed by encryption with the Rust/C payload and a leak-site listing to pressure payment. - Provisional lead note: the hash and domain reviewed in this assessment reached only a ‘suspicious/provisional’ verdict in automated triage – flagged by reputation signals but without strong behavioural corroboration – and are not confirmed to belong to Qilin.
Qilin affiliate attack chain
It’s a RaaS: many affiliates, one playbook – stop the intrusion early, before staging and encryption.
Attribution
Qilin is a well-documented RaaS operation (formerly Agenda) whose operators recruit Russian-language-forum affiliates; confidence in the group profile and tradecraft above is high and drawn from multiple vendor reports. However, the two indicators examined in the source triage (a file hash and a domain) are provisional, low-corroboration leads and are NOT confirmed as Qilin infrastructure – treat any Qilin attribution of those specific indicators as unverified pending strong, behaviour-based evidence.
Qilin didn’t win the ransomware market by being novel – it won by being the landing pad every displaced affiliate needed.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Phishing | T1566 | Affiliates phish credentials, including admin credentials for MSP remote-management tools such as ScreenConnect. |
| Initial Access | Exploit Public-Facing Application | T1190 | Exploitation of internet-facing applications is a recurring Qilin initial-access vector. |
| Initial Access | External Remote Services | T1133 | Abuse of RDP and VPN access, with harvested VPN credentials used for persistent footholds. |
| Credential Access | Credentials from Password Stores: Web Browsers | T1555.003 | Affiliates steal Google Chrome-stored credentials prior to triggering encryption. |
| Lateral Movement | Remote Services | T1021 | PsExec, NetExec and WinRM are used to move laterally and execute across hosts. |
| Defense Evasion | Indirect Command Execution (WSL abuse) | T1202 | Windows Subsystem for Linux is abused to run payloads outside the visibility of some EDR tooling. |
| Exfiltration | Exfiltration to Cloud Storage | T1567.002 | Data is staged (e.g. with WinRAR) and exfiltrated to file-sharing services such as easyupload[.]io. |
| Impact | Data Encrypted for Impact | T1486 | Rust/C ransomware encrypts victim data as part of a double-extortion scheme. |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
| 1139b39d3cc151ddd3d574617cf113608127850197e9695fef0b6d78df82d6ca | sha256 | Provisional lead – flagged malicious by 45 VirusTotal engines; Qilin association unconfirmed, treat as suspicious pending behavioural corroboration |
www[.]drivelivelime[.]com | domain | Provisional lead – possible credential-phishing infrastructure using a ‘live’ brand pretext; not confirmed as Qilin infrastructure |
Detection
Copy-ready hunting query:
# Provisional indicators from this triage (treat as suspicious, not confirmed Qilin)
index=edr sha256="1139b39d3cc151ddd3d574617cf113608127850197e9695fef0b6d78df82d6ca"
| stats count values(host) as hosts by process_name, parent_process
index=dns OR index=proxy
| search domain="www.drivelivelime.com" OR domain="drivelivelime.com"
# Behavioural hunts for Qilin-style affiliate activity (higher-value than any single IOC):
# 1) Remote-management tool abuse (ScreenConnect) launching cmd/powershell/psexec children
# 2) Browser credential access: non-browser processes reading Chrome 'Login Data'
# 3) Lateral movement via PsExec / NetExec / WinRM in short bursts across many hosts
# 4) WSL execution (wsl.exe / bash.exe) spawning unexpected payloads
# 5) Mass staging with WinRAR + egress to file-sharing sites (e.g. easyupload[.]io)
# 6) Volume Shadow Copy deletion immediately before mass file modificationRecommendations
- Harden the common Qilin entry points: enforce MFA on all remote access (RDP/VPN) and MSP tools, restrict and monitor ScreenConnect/remote-management usage, and rapidly patch internet-facing applications.
- Detect the intrusion before encryption: alert on browser-credential access by non-browser processes, PsExec/NetExec/WinRM lateral bursts, unexpected WSL execution, and mass WinRAR staging with egress to file-sharing sites.
- Treat the two indicators here as provisional – block/monitor the hash and domain, but corroborate with a second independent source (sandbox, passive DNS, behavioural telemetry) before promoting to a confirmed Qilin verdict.
- Prepare for double extortion: maintain tested offline/immutable backups, and rehearse an IR plan that assumes data theft as well as encryption, given Qilin’s leak-site pressure model.
