Qilin – Threat Actor Profile

Group Alias & Alternative Names	Qilin aka Agenda (Main Name); Gold Feather (Secureworks); Water Galura (Trend Micro)
Motivation	Financial Gain; Political
Threat Classification	CyberCrime
Amount of Available Information	High
Date of Profile Publication or date of last update	September 26, 2025
Profile author/ Analyst	Anastasia Sentsova
Date of Activity	July 2022 to Present

Overview

Qilin is a ransomware group operating since approximately July 2022. Based on ransom notes distributed to victims, the group initially operated under the name Agenda before rebranding as Qilin in September 2022.

Originally developed in the Go programming language (Golang), the ransomware supported cross-platform attacks against both Windows and Linux systems. The rebrand coincided with the release of a more advanced Rust-based variant, which improved the ransomware’s efficiency, stealth, and ability to evade detection.

The group promotes a Ransomware-as-a-Service model and attracts affiliates through various channels, including Dark Web forums and Telegram. Unlike most groups traditionally known to avoid working with English-speaking individuals, Qilin allows such collaboration after conducting interviews.

The group has a Russian origin, which actors openly state. On top of that, they openly leverage their brand identity to attract Russian citizens to promote engagement in illicit activity. While it is unclear if the group might be a hybrid of nation-state and traditional ransomware, they demonstrate a strong alignment with Russian strategic interests and reflect the broader militarization of society strategy, where the digital space serves as an extension of state power.

Operations & TTPs

• Access & Infiltration

Qilin gains initial access using a variety of methods:

• Spear-phishing and other phishing campaigns targeting credentials or executing malicious payloads
  • Compromised Remote Desktop Protocol (RDP) or Remote Monitoring and Management (RMM) tools and vulnerabilities in Internet-facing services (e.g., Fortinet VPN, Veeam Backup vulnerabilities)
• Persistence & Defense Evasion
  • Use of valid (often leaked or purchased) accounts (MITRE T1078).Establishment of scheduled tasks, registry run keys, and startup folder entries for persistence (MITRE T1053.005, T1547.001)
  • Techniques like rebooting into Safe Mode, disabling Windows event logging, process injection, modifying Group Policy or registry settings, and credential harvesting from files are regularly employed to hinder detection (MITRE T1562.009, T1562.002, T1055, T1484.001, T1112, T1552.001)
• Lateral Movement

Exploits include the use of removable media, remote services, lateral tool transfer, and exploitation of vulnerable services to move within victim networks (MITRE T1091, T1021, T1133, T1190)

Extortion Phase

The extortion phase in a ransomware incident relies less on technical vulnerabilities and more on exploiting human and organizational pressure points. Qilin actors employ multiple coercive tactics to maximize leverage over their victims.

Qilin follows the now-standard double-extortion approach, exfiltrating sensitive data before encrypting systems. Victims are then threatened with data publication on a dedicated leak site (DLS) if ransom is not paid, amplifying reputational and regulatory risks.

In addition, Qilin positions itself not only as a ransomware provider but as a full-service extortion ecosystem. A recent update (May 2025) introduced a “Call Lawyer” button in the Qilin panel. Beyond encryption and data leaks, the group has introduced special services for affiliates designed to increase leverage over victims and maximize ransom payouts.

According to Qilin’s forum posts, affiliates now offered an access to an internal legal team. If a victim refuses to negotiate or delays payment, Qilin claims that specialists will exert pressure by highlighting supposed legal violations committed by the victim organization. These materials are then “sent” to regulatory and law-enforcement bodies (tax authorities, regulators, police, FBI equivalents).

• Goal: To create the impression that refusal to pay could trigger even greater consequences, including official investigations, fines, or criminal liability.
• Impact on Double Extortion: This adds a third layer of pressure, not just encryption and leaks, but also the threat of reputational and legal fallout engineered through fabricated or selectively released information.

Based on the available negotiation chat dated February 2025, Qilin displayed a structured and professional approach. They began with detailed assurances, offering decryption proofs, file lists, and promises of confidentiality to build credibility. Like many ransomware groups, they employed “proof-of-life” tactics, decrypting sample files to demonstrate their capabilities to the victim.

Qilin framed payments as bundled: data deletion, decryption, and secrecy were only available together, rejecting attempts to purchase partial services. Their pricing strategy was flexible but controlled, with an initial demand followed by a 10% discount, framed as goodwill.

Throughout the process, Qilin relied heavily on psychological pressure. They set clear deadlines, extended them slightly to show “reasonableness,” and escalated threats of public exposure when delays persisted. The overall tone was calm but firm, emphasizing that non-payment would result in maximum damage.

On-Chain Behavior

This section highlights known patterns of Qilin’s financial operations based on the collected off-chain intelligence. While this provides useful indicators, reliable conclusions about their on-chain behavior require analysis of a larger dataset attributed to the group.

Understanding Qilin’s payment structure can provide valuable context for on-chain tracking. Payment splits help distinguish between the core operators and their affiliates, offering insights into how funds are distributed.

Qilin runs as a Ransomware-as-a-Service (RaaS). According to program details:

• For ransom payments $3 million or less, affiliates receive 80%.
• For ransom payments over $3 million, affiliates receive 85%.

Other potential indicators of on-chain behavior include the required payment from English-speaking individuals to access the Qilin panel. The announced entrance fee of $5,000 back in April 2023, refundable after the first successful payout, may serve as a strong indicator for attribution. This payment structure could provide investigators with a valuable trace, potentially linking a specific affiliate to a ransomware attack when following the transaction chain.

Victims:

Based on the observed communication on the DarkWeb, in their promotion of RaaS to affiliates, it is prohibited to attack former CIS countries, as well as the relatively newly observed introduction of not attacking BRICS countries.

Since October 2022, Qilin has listed 775 companies on its data leak site. We call these listings “claims” because ransomware groups sometimes post false or exaggerated entries, so not all may be confirmed victims.

Industries affected include healthcare, pharmaceuticals, manufacturing, construction, engineering, professional services, legal, finance, retail, telecommunications, and energy. Healthcare and life sciences have been especially impacted, with notable disruptions to hospitals and laboratory services.

Claimed Healthcare entities include:

• Synnovis / NHS Pathology (UK, June 2024): Attack on Synnovis, a major pathology services provider for NHS hospitals in London, caused mass cancellations of surgeries and diagnostics. Qilin stole and leaked 400 GB of data, affecting millions of patient records. UK health officials later confirmed the disruption contributed to a patient’s death due to delayed test results.
• APDerm (US, August 2025): Qilin claimed responsibility for an attack on APDerm, a large New England healthcare provider, threatening to release sensitive medical and patient data unless ransom demands were met.

Most of Qilin’s claimed victims are in the United States (54%), with smaller but notable shares in Canada (6%), France (5%), and the United Kingdom (4%). Other countries include Italy (3%), Germany (3%), Spain (2%), and Australia (2%), while South Korea and Singapore each account for about 1%. The remaining 19% come from various other countries, showing that Qilin’s activity has a broad global reach.

Notably, Qilin’s victims’ list also extended to one Ukrainian victim, the Ministry of Foreign Affairs of Ukraine, targeted in March 2025 despite the “rule” of not attacking former CIS countries. This indicates a strong political alignment with the Russian state. While the full extent is unknown, we also see many points in their communications and community-building efforts that confirm such alignment, which we examine in the next section.

Infrastructure & Communications

Qilin is largely present across Russian-speaking Dark Web forums such as DutyFree and RAMP (see threat actor forum profiles below), with a high level of activity observed on both. Communications (in Russian) include facilitation, commentary, and reactions across multiple threads, notably Qilin RaaS operations, buying of initial access (IAB activity), Rocket Chat configuration, and other operational matters.

DutyFree, in particular, is an interesting case, as the actors appear to be involved in the forum’s operations and support. Launched in February 2025, the forum’s administration began promoting it on Telegram through the DutyNews channel. Qilin has been promoted through multiple posts on the DutyNews Telegram channel, and a banner featuring them is currently displayed at the top of the DutyFree forum.

Some of the observed messages include:

On June 2, 2025, the DutyNews Telegram channel published a post promoting the Qilin ransomware group, specifically its “TRAMP” team. The message was styled as a recruitment advertisement for remote pentesters, presented under the guise of “ethical hacking” and “bug bounty.”

The post outlined what applicants could expect if they joined the TRAMP team, including:

• Training from a team lead on basic skills.
• Immediate access to a cyber range for hands-on practice instead of theory.
• Communication via RocketChat with other pentesters to share experience.
• Legal support and connections in Moscow.
• Fully “white” salary, with the option to receive cash, and an office near Barvikha (Author’s note: Barvikha is a wealthy suburban village outside Moscow, known for its luxury residences)

The post emphasized “real practice” obtained through corporate audit contracts rather than relying on publicly available exploits, while also hinting at possible past involvement in operations against Ukraine’s Ministry of Foreign Affairs. It included a link to a DutyFree forum thread advertising the opportunity for would-be recruits. What is particularly notable is that the actors make little to no effort to conceal or obfuscate their origin. On the contrary, they openly leverage their brand identity to attract Russian citizens specifically.

On June 5, 2025, the DutyNews Telegram channel published a post about the Qilin ransomware group, describing who they are and what they are known for.

The message summarized Qilin’s background as a Russian-speaking cybercriminal organization linked to ransomware incidents, including attacks on hospitals in London. It compared their malware to REvil and BlackBasta, referenced Group-IB’s 2023 findings on the group’s revenue model, and noted that Positive Technologies ranks them among the most dangerous ransomware providers.

The post portrayed Qilin as one of the most successful hacker gangs in 2025, with monthly revenues in the millions. It highlighted their strategy of avoiding BRICS countries but freely targeting Ukraine and its critical infrastructure, citing a recent breach of Ukraine’s Ministry of Foreign Affairs.

In addition, DutyNews posted messages claiming that their new domain was gifted to them by Qilin, posted on July 7, 2025. They also stated that, during the recent XSS forum takedown and its alleged new ownership by law enforcement, Qilin carried out a DDoS attack against the forum in retaliation. (posted on August 4, 2025)

Qilin’s Associated Actors, User Profiles, and Other IOCs:

Platform: DutyFree Forum

Actor Profile Link: https://forum[.]duty-free[.]cc/members/1721/

Alias: Qilin (registered on May 29, 2025)

Platform: DutyFree Forum

Actor Profile Link: https://forum[.]duty-free[.]cc/members/1752/

Alias: TRAMP (registered on May 31, 2025)

Platform: RAMP Forum

Actor Profile Link: http://rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd[.]onion/members/haise[.]2209/

Alias: Haise (registered on May 29, 2022)

Jabber: qilin@exploit[.]im

TOX ID: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD 6995152B68

Data Leak Site: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/

Attribution Theory

Qilin differs from older ransomware groups by combining cybercrime with political signaling and prominent branding. Rather than hiding in the shadows, the group maintains a significant public presence through leak sites, recruitment campaigns, and active forum communication, framing ransomware as both profitable and aligned with “patriotic” goals.

Operationally, Qilin extended its rule against attacking CIS countries also to include BRICS members but broke this principle in March 2025 by targeting the Ukrainian Ministry of Foreign Affairs. This exception points to a selective targeting logic that reflects alignment with Russian geopolitical interests, where Ukraine is treated as an adversary despite the group’s broader restrictions.

Their communications reinforce this view. Qilin openly uses Russian language, slang, and cultural references, while simultaneously welcoming English-speaking affiliates to expand their reach and market the RaaS program globally. At the same time, they actively appeal to Russian-speaking individuals both inside Russia and abroad.

While it remains uncertain whether Qilin is a true hybrid of state-linked and criminal operations, its behavior consistently reflects a political dimension, where ransomware is framed not only as a criminal enterprise but also as part of the broader militarization of society, with the digital domain serving as an extension of state power. In contrast to earlier ransomware models focused purely on financial gain, Qilin blends profit motives with political and ideological justification, signaling a more hybrid threat, part criminal enterprise, part geopolitical instrument.