QILIN (aka “Agenda”) Ransomware: Rust, RaaS, and Ruthless Efficiency—What Defenders Need to Know

Executive Summary

In the endless chess game of cybersecurity, the Russian-speaking QILIN (formerly Agenda) group has just made a checkmate-worthy move. In 2025, it’s the most active ransomware operation worldwide. Like the mythical Chinese Qilin it’s named after, this malware is powerful, adaptable, and unfortunately—very real.

And yes—before diving into the weeds—let’s acknowledge the irony: naming your ransomware after a symbol of “peace and prosperity” is either top-tier trolling or some dark attempt at branding. Either way, it’s working far too well.

The Rise of the Dragon: QILIN’s Meteoric Ascent

QILIN didn’t stumble into dominance; it engineered it. The group began as Agenda ransomware in July 2022, then rebranded to QILIN in September that year with a full architectural migration from Golang to Rust. That move wasn’t cosmetic—it marked a technical revolution.

Key Milestones

• $50+ million in confirmed ransom payments (2024)

• 1,700+ attacks with FBI-estimated revenue of $91M (likely underreported)

• Operations spanning 25+ countries across six continents

• Three consecutive months leading global ransomware activity (May–July 2025)

Like a Silicon Valley startup (albeit an evil one), QILIN runs a slick Ransomware-as-a-Service (RaaS) model:

• Affiliate programs with 80–85% revenue sharing

• 24/7 “legal support” (yes, there’s a “Call Lawyer” button)

• In-house “journalists” for extortion campaigns

• Automated propagation and negotiation tooling

QILIN is less a ransomware gang and more a criminal SaaS company with a very dark business model.

The Numbers Don’t Lie: QILIN’s Market Dominance

2025 Landscape

Source: ransomware.live

QILIN is officially the dragon at the top of the food chain.

Industry Targeting

Geography

Source: ransomware.live

Technical Architecture: The Devil in the Rust

Core Variants

• QILIN.A (2022 – Golang era)

  • Cross-platform (Windows/Linux)

  • Basic encryption, limited evasion

• QILIN.B (2024–present – Rust era) A quantum leap in sophistication.

// Simplified Encryption Stack AES-256-CTR + ChaCha20 + RSA-4096 (OAEP padding)

Encryption Highlights:

• AES-256-CTR for speed

• ChaCha20 for modern stream cipher performance

• RSA-4096 with OAEP for asymmetric key protection

• Configurable modes: normal, step-skip, fast, percent

Evasion & Anti-Forensics Toolkit:

• Process injection

• Event log clearing & shadow copy deletion

• Self-deletion post-execution

• Chrome extension credential theft

• Obfuscated APIs & dynamic loading

Tactical Innovations

1. Legal Warfare – “Call Lawyer” button weaponizes compliance and fines.

2. Fortinet Exploits – Automation of CVE-2024-21762 & CVE-2024-55591.

3. Linux Gunra Variant – 100 parallel threads, forensic resistance, stealth mode (no ransom note).

Attack Lifecycle: QILIN’s Playbook

• Initial Access: spearphishing, RMM abuse, VPN compromise, public app exploits, MFA fatigue

• Privilege Escalation: LSASS dumping, valid account abuse, SMB/RDP traversal, PowerShell AD enumeration

• Data Exfil & Encryption: MEGA staging, FTP transfers (>700 GB observed), parallelized encryption (100+ threads Linux variant)

Case Study

In February 2024, QILIN crippled a known UK-based pathology provider:

• $50M ransom demand

• 400 GB of medical data stolen

• 170 cases of patient harm, including one confirmed death

• 6,000+ cancelled procedures across NHS hospitals

Adding insult to injury, QILIN issued an apology:

“We are very sorry… Herewith we don’t consider ourselves guilty…”

Yes, the dragon apologized—sort of. A reminder that even cybercriminals know crossing into physical harm risks existential blowback.

End-To-End MITRE Mapping & Detection Opportunities

Defense Digest:

• Patch & Harden Systems – Regularly update OS, applications, and firmware to close exploitable vulnerabilities.

• Zero Trust Access – Enforce least privilege, MFA, and segmentation to limit lateral movement.

• Offline & Immutable Backups – Maintain encrypted, offline/offsite backups with regular recovery testing.

• Email & Web Filtering – Block malicious attachments, links, and exploit delivery channels.

• Network Segmentation – Isolate critical workloads and restrict SMB/RDP traffic exposure.

• Endpoint Protection & EDR – Apply behavior-based defense with automated response capabilities.

• User Awareness & Drills – Train employees on phishing/social engineering and conduct tabletop exercises.

• Incident Readiness – Have a tested ransomware playbook with defined contacts, containment, and recovery procedures.

Conclusion: The Dragon’s Reign and Our Response

QILIN’s success blends technical excellence, startup-like business ops, and ruthless opportunism. But empires fall—especially when they attract too much light. Healthcare attacks invite nation-state retaliation, and affiliate models leave breadcrumbs.

For defenders, the path forward is clear:

• Hunt proactively across the kill chain

• Share intelligence to trace affiliates

• Architect with resilience-first principles

• Drill responses like lives (and businesses) depend on it—because they do

Track recent breaches, security incidents, and critical vulnerabilities—get the latest updates, impact analysis, and cloud-ready mitigation steps in one place. View Recent Breaches & Vulnerabilities.

Reference

1. https://blog.qualys.com/vulnerabilities-threat-research/2025/06/18/qilin-ransomware-explained-threats-risks-defenses

2. https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/qilin-ransomware/

3. https://www.darktrace.com/blog/a-busy-agenda-darktraces-detection-of-qilin-ransomware-as-a-service-operator

4. https://www.cybereason.com/blog/threat-alert-qilin-seizes-control

5. https://blog.barracuda.com/2025/07/18/qilin-ransomware-growing

6. https://cyble.com/blog/ransomware-groups-july-2025-attacks/