Full Report
All you need to know about Qilin ransomware and its operations targeting critical sectors.
Analysis Summary
# Tool/Technique: Qilin Ransomware (aka Agenda)
## Overview
Qilin (formerly known as Agenda) is a sophisticated Ransomware-as-a-Service (RaaS) operation that emerged in mid-2022. It is written in Go (Golang) and Rust, making it highly customizable and cross-platform. The group employs a "double extortion" tactic, where they steal sensitive data before encrypting files, threatening to leak the information on their dedicated leak site if the ransom is not paid. Qilin is notable for its focus on critical infrastructure and its high level of configuration flexibility for affiliates.
## Technical Details
- **Type:** Malware Family (Ransomware-as-a-Service)
- **Platform:** Windows, Linux (ESXi)
- **Capabilities:** Credential harvesting, service termination, cross-platform execution (Rust/Go), lateral movement, and data exfiltration.
- **First Seen:** August 2022 (as Agenda); rebranded to Qilin in late 2022.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1190 - Exploit Public-Facing Application
- T1133 - External Remote Services
- **TA0007 - Discovery**
- T1087 - Account Discovery
- T1082 - System Information Discovery
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Desktop Protocol
- **TA0009 - Collection**
- T1005 - Data from Local System
- **TA0010 - Exfiltration**
- T1048 - Exfiltration Over Alternative Protocol
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1489 - Service Stop
- T1490 - Inhibit System Recovery
## Functionality
### Core Capabilities
- **Cross-Platform Execution:** Utilizes Rust and Go to target both Windows environments and Linux-based hypervisors (VMware ESXi).
- **Customizable Payloads:** Affiliates can configure the ransomware to target specific extensions, exclude directories, and define the encryption process via a user-friendly management panel.
- **Service Termination:** Automatically identifies and stops critical processes (databases, antivirus, backup software) to ensure files are not locked and encryption is successful.
- **Shadow Copy Deletion:** Deletes Volume Shadow Copies to prevent local data recovery.
### Advanced Features
- **Safe Mode Execution:** Some variants can reboot the infected machine into "Safe Mode" to bypass security software that does not run in that state, facilitating unimpeded encryption.
- **Credential Harvesting:** Specialized modules designed to scrape credentials from browsers (e.g., Chrome, Microsoft Edge) to facilitate further lateral movement.
- **Automation:** Includes scripts to automate the deployment across a domain using compromised administrative credentials.
## Indicators of Compromise
- **File Hashes:**
* *(Note: Specific hashes vary per build; representative samples show high entropy and unique Rust-based signatures)*
- **File Names:** `[random_string].exe`, `agenda.exe` (older variants).
- **Registry Keys:** `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run` (Persistence).
- **Network Indicators:**
* `qilin-leak[.]onion` (Defanged)
* `khd-storage[.]com` (Defanged - common exfiltration point)
- **Behavioral Indicators:**
* Execution of `vssadmin.exe delete shadows /all /quiet`.
* Sudden termination of `sqlservr.exe`, `veeam.exe`, or `oracle.exe`.
* Mass renaming of files to a specific affiliate-defined extension (e.g., `.qilin`, `.agenda`).
## Associated Threat Actors
- **Qilin/Agenda Group:** A RaaS operator primarily recruiting affiliates via dark web forums.
- **Affiliates:** Various unnamed cybercriminal groups specializing in initial access and network penetration.
## Detection Methods
- **Signature-based:** Detection of Rust-based compiled binaries with specific Qilin code patterns.
- **Behavioral detection:** Monitoring for the mass renaming of files and the simultaneous execution of commands to delete shadow copies or stop database services.
- **YARA:** Rules targeting the unique Qilin configuration block (usually found at the end of the binary) and its specific implementation of the Chacha20 or AES encryption algorithms.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA):** Enforce MFA on all remote access points, including VPNs and RDWeb interfaces.
- **Network Segmentation:** Isolate critical servers and ESXi hypervisors from general employee workstations.
- **Immutable Backups:** Maintain offline, encrypted, and immutable backups to ensure recovery without paying the ransom.
- **Patch Management:** Prioritize patching of public-facing vulnerabilities (e.g., Fortinet, Citrix, Exchange).
## Related Tools/Techniques
- **LockBit:** Similar RaaS model and targeting of ESXi environments.
- **BlackCat (ALPHV):** Use of Rust for ransomware development.
- **Rclone:** Often used by Qilin affiliates for automated data exfiltration prior to encryption.