Log in Request a demo

Ransomware group profile

Qilin

Also known as Agenda, Water Galura (operators)

Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022.

  • Active

In short

Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. It has Go and Rust versions that target Windows, Linux and VMware ESXi. Ransomware as a service means the core team rents its malware to partner criminals, called affiliates.

Profile MapRansomware Group
  1. StatusActiveas reported
  2. Other Names2names in public reportsAgenda · Water Galura (operators)
  3. Entry Routes5ways inPhishing attachments and links · Remote management tools · Disabling security tools
  4. Techniques6mapped to MITRE ATT&CKOS Credential Dumping · Remote Services
  5. Defences7first steps listedUse phishing-resistant MFA · Do not expose remote desktop

Overview

Qilin is ransomware offered as a service. According to MITRE ATT&CK, it has been active since at least 2022 and is also tracked under the name Agenda. Its variants are written in Go and Rust and can attack Windows, Linux and VMware ESXi (the software that runs many virtual machines on one host).

A note on sources: for this group the official material is thinner than for some others. The pages opened for this profile are MITRE ATT&CK entries, a Welsh NHS health board notice and CISA’s general ransomware guide. We found no joint government advisory about Qilin that could be opened and checked.

Who runs it

MITRE ATT&CK names the operators as Water Galura. They handle payload generation, ransom negotiations and publication of stolen data. Affiliates are recruited on Russian cybercrime forums. The operators run a news channel on Telegram to make announcements for Qilin. MITRE describes the model as double extortion: pay for the decryption keys, and pay again so the stolen data is not published.

Scale and targets

MITRE says Qilin affiliates have targeted entities worldwide, with the majority of victims in the United States, France, Canada and the United Kingdom, mainly in manufacturing, technology, financial services and healthcare. We do not repeat victim counts here, because the official pages opened do not give a verified total.

How it works

MITRE says Qilin has reached victims through malicious email attachments and links, and through exploitation of exposed applications such as Citrix and Remote Desktop. Once inside, it can embed a Mimikatz module to dump passwords, use PsExec to run on other machines, push tasks to many computers through Group Policy, stop antivirus processes and reboot into safe mode to avoid detection. It deletes volume shadow copies, can reboot the backup server to hinder recovery, and has been deployed on VMware vCenter and ESXi servers. It can run its Linux version on Windows through a remote management service. HHS says the Everest group also uses the Splashtop remote access tool, to move stolen data out of a network. After encryption it changes the desktop wallpaper to show the ransom message.

Healthcare incident

A Cardiff and Vale University Health Board notice says NHS England confirmed patient data was stolen in a ransomware attack on 3 June on a pathology services provider, affecting two NHS England trusts. It says the attack is understood to have been carried out by the Russian group Qilin, and that data was shared publicly on 20 June. Operations and appointments were canceled in the weeks after. See our incident page for the full story.

Qilin in official sources
  1. 2022Active since at leastMITRE ATT&CK dates Qilin activity to at least 2022.
  2. 3 JunePathology provider attackedNHS England confirms patient data stolen in a ransomware attack (see the incident page).
  3. 20 JuneData shared publiclyThe health board notice says stolen data was shared on Telegram.
  4. 26 September 2025MITRE adds Qilin software entryMITRE ATT&CK created entry S1242.
  5. 29 September 2025MITRE adds operator groupMITRE ATT&CK created group entry G1050 (Water Galura).
At a glance
Model
Ransomware as a service
Also called
Agenda
Operators (MITRE)
Water Galura
Versions
Go and Rust, for Windows, Linux and ESXi
Extortion
Double extortion with a leak site
Main victim countries (MITRE)
US, France, Canada, UK

Techniques MITRE lists for the Qilin software

The MITRE ATT&CK entry for Qilin (S1242) maps the ransomware to dozens of techniques. They include exploiting public-facing applications (T1190), spearphishing attachments and links (T1566.001, T1566.002), dumping credentials from LSASS memory (T1003.001), changing Group Policy (T1484.001), moving over SMB and SSH (T1021.002, T1021.004), and clearing Windows event logs (T1685.005). On impact it lists data encryption (T1486), inhibiting system recovery (T1490), stopping services (T1489), booting into safe mode (T1688) and internal defacement, the wallpaper change (T1491.001). The same page lists a second group, Moonstone Sleet (G1036), as using Qilin, besides Water Galura. MITRE’s group page for Water Galura maps the operators to data encryption (T1486), social media accounts (T1585.001) and financial theft (T1657), and lists the Tor software (S0183) next to Qilin.

Tools that switch off security software

An August 16, 2025 advisory from the Cyber Security Agency of Singapore says eight ransomware groups, including Qilin, DragonForce and Lynx, are using a tool that disables endpoint detection and response (EDR) products. The agency says this lets operators bypass endpoint defenses. Its advice includes enforcing kernel mode code signing, using EDR products that resist being terminated, patching drivers and watching for unusual attempts to stop security services.

Law enforcement action

The official sources opened for this page do not describe an arrest, takedown or sanction. Check stopransomware.gov and national cyber agencies for newer statements.

Also known as

  • Agenda
  • Water Galura (operators)

How they get in

  1. 01

    Phishing attachments and links

    MITRE says Qilin has been delivered through malicious email attachments and links in spearphishing emails.

  2. 02

    Exposed applications and remote access

    Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and Remote Desktop. The MITRE entry names no specific CVE.

  3. 03

    Remote management tools

    Qilin can use the Splashtop remote management service to run its Linux ransomware binary on Windows systems.

  4. 04

    Exploit public-facing applications

    MITRE lists T1190, Exploit Public-Facing Application, among Qilin's techniques.

  5. 05

    Disabling security tools

    The Cyber Security Agency of Singapore says Qilin is among eight groups using a tool that disables endpoint detection and response products.

How they extort

Double extortion, per MITRE ATT&CK: the operators demand payment for decryption keys and for not publishing stolen data on their leak site. They also run a Telegram news channel to announce Qilin activity.

Who they target

  1. 01

    Manufacturing

    See the industry page
  2. 02

    Technology

    See the industry page
  3. 03

    Financial services

    See the industry page
  4. 04

    Healthcare

    See the industry page

How to defend

  1. Keep offline, encrypted backups

    Maintain offline, encrypted backups of critical data and test them. Qilin deletes shadow copies and can reboot the backup server.

  2. Use phishing-resistant MFA

    Implement phishing-resistant MFA for all services, especially email, VPNs and accounts that reach critical systems.

  3. Do not expose remote desktop

    Do not expose services such as Remote Desktop Protocol on the web, and limit its use where you must keep it.

  4. Segment the network

    Use logical or physical segmentation so that an intrusion cannot spread freely, including to virtualization and backup servers.

  5. Control remote management tools

    Block inbound and outbound connections on common remote management ports and protocols at the network perimeter.

  6. Log and alert

    Enable logging on all resources and set alerts for abnormal usage. Qilin has been deployed on vCenter and ESXi servers, so cover those too.

  7. Protect security agents from being switched off

    Enforce kernel mode code signing, use endpoint products that resist termination, and alert on unusual attempts to stop security services, per the Cyber Security Agency of Singapore.

Questions

What is Qilin ransomware?

Qilin, also tracked as Agenda, is a ransomware as a service family. MITRE ATT&CK says it has been active since at least 2022, with Go and Rust versions that target Windows, Linux and VMware ESXi.

How does Qilin get into a network?

MITRE says Qilin has been delivered through malicious email attachments and links, and through exploitation of exposed applications such as Citrix and Remote Desktop. It can also use the Splashtop remote management service.

Does Qilin steal data as well as encrypt it?

Yes. MITRE describes double extortion: the operators demand payment for decryption keys and again so that stolen data is not published on their leak site.

Which sectors does Qilin target?

MITRE says affiliates have mainly hit manufacturing, technology, financial services and healthcare, with most victims in the United States, France, Canada and the United Kingdom.

How can organizations defend against Qilin?

Keep offline, encrypted backups, use phishing-resistant MFA, do not expose Remote Desktop, segment the network and log and alert on abnormal use. Qilin deletes shadow copies and can reboot the backup server.

Who else uses Qilin?

MITRE ATT&CK lists two groups as using the Qilin software: Water Galura (G1050), the operators, and Moonstone Sleet (G1036).

Does Qilin turn off antivirus and EDR?

MITRE lists Disable or Modify Tools (T1685) for Qilin. A separate August 2025 advisory from the Cyber Security Agency of Singapore names Qilin among eight groups using a tool that disables endpoint detection and response products.

Has Qilin been taken down?

The official sources opened for this page describe no arrest, takedown or sanction.

In our research

  1. Agenda Ransomware’s New Rust Variant Targets Critical Sectors December 2022
  2. Ransomware examples: attacks, types and groups October 2026
  3. Five edge VPN flaws CISA flags for ransomware use October 2026
  4. Exploited vulnerabilities in 2025: what ENISA reports October 2026
  5. Top 10 Ransomware Variants Reported to the FBI in 2025 October 2026
  6. ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026

Sources

  1. Qilin, Software S1242 MITRE ATT&CK
  2. Water Galura, Group G1050 MITRE ATT&CK
  3. Cyber incident involving Synnovis system within two NHS England Trusts Cardiff and Vale University Health Board (NHS Wales)
  4. #StopRansomware Guide CISA
  5. Advisory on New Endpoint Detection and Response (EDR) Killer Tool Used by Multiple Ransomware Groups Cyber Security Agency of Singapore

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more