S1242: Qilin

S1242: Qilin describes [Qilin](https://attack.mitre.org/software/S1242) is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. [Qilin](https://attack.mitre.org/software/S1242) shares functionality overlaps with [Black Basta](https://attack.mitre.org/software/S1070), [REvil](https://attack.mitre.org/software/S0496), and [BlackCat](https://attack.mitre.org/software/S1068) rans...

Executive priority

S1242: Qilin is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1242: Qilin by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (ESXi, Windows, Linux), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1242: Qilin appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Qilin

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.[1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques52 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.CitationHC3 Qilin Threat Profile JUN 2024
Enterprise	T1082	System Information Discovery	Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.[5]
Enterprise	T1134	Access Token Manipulation	Qilin can use an embedded Mimikatz module for token manipulation.CitationPicus Qilin MAR 2025
Enterprise	T1480.002	Mutual ExclusionSub-technique	Qilin can create a mutex to ensure only one instance is running.CitationHalcyon Qilin.B OCT 2024
Enterprise	T1547.004	Winlogon Helper DLLSub-technique	Qilin can configure a Winlogon registry entry.[1]
Enterprise	T1529	System Shutdown/Reboot	Qilin can initiate a reboot of the backup server to hinder recovery.CitationPicus Qilin MAR 2025
Enterprise	T1071.002	File Transfer ProtocolsSub-technique	Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.[5]
Enterprise	T1087.001	Local AccountSub-technique	Qilin can list all local users found on a targeted system.[1]
Enterprise	T1489	Service Stop	Qilin can terminate specific services on compromised hosts.[1]CitationHalcyon Qilin.B OCT 2024CitationHC3 Qilin Threat Profile JUN 2024CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1566.002	Spearphishing LinkSub-technique	Qilin has been delivered via malicious links in spearphishing emails.[2][4]
Enterprise	T1047	Windows Management Instrumentation	Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1106	Native API	Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.[1]CitationHalcyon Qilin.B OCT 2024
Enterprise	T1036.004	Masquerade Task or ServiceSub-technique	Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer. CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1673	Virtual Machine Discovery	Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.CitationHalcyon Qilin.B OCT 2024CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.CitationPicus Qilin MAR 2025
Enterprise	T1480	Execution Guardrails	Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.CitationPicus Qilin MAR 2025[5]
Enterprise	T1021.002	SMB/Windows Admin SharesSub-technique	Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.CitationPicus Qilin MAR 2025CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1057	Process Discovery	Qilin can define specific processes to be terminated or left alone at execution.[1][2]CitationHalcyon Qilin.B OCT 2024CitationHC3 Qilin Threat Profile JUN 2024[5]CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1053.005	Scheduled TaskSub-technique	Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.[3][1] Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1112	Modify Registry	Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.CitationHalcyon Qilin.B OCT 2024CitationPicus Qilin MAR 2025 Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1135	Network Share Discovery	Qilin has the ability to list network drives.[1]CitationHalcyon Qilin.B OCT 2024
Enterprise	T1685.005	Clear Windows Event LogsSub-technique	Qilin has the ability to clear Windows Event Logs.CitationHalcyon Qilin.B OCT 2024[4]
Enterprise	T1007	System Service Discovery	Qilin can identify specific services for termination or to be left running at execution.[1][2]CitationHC3 Qilin Threat Profile JUN 2024CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1570	Lateral Tool Transfer	Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1012	Query Registry	Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.[1]
Enterprise	T1069.002	Domain GroupsSub-technique	Qilin can run PowerShell cmdlets to discover domain groups.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1016	System Network Configuration Discovery	Qilin can accept a command line argument identifying specific IPs.[1]
Enterprise	T1680	Local Storage Discovery	Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.CitationHalcyon Qilin.B OCT 2024
Enterprise	T1222	File and Directory Permissions Modification	Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.CitationPicus Qilin MAR 2025CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1486	Data Encrypted for Impact	Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.[1][2]CitationPicus Qilin MAR 2025[3]CitationHalcyon Qilin.B OCT 2024CitationHC3 Qilin Threat Profile JUN 2024[5]CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1204.001	Malicious LinkSub-technique	Qilin has been executed by luring victims into clicking links in spearphishing emails.[2][4]
Enterprise	T1190	Exploit Public-Facing Application	Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.[1]CitationHalcyon Qilin.B OCT 2024CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1484.001	Group Policy ModificationSub-technique	Qilin has pushed a scheduled task via a Group Policy Object for payload execution.[1][3]
Enterprise	T1021.004	SSHSub-technique	Qilin can enable SSH access on ESXi hosts.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1003.001	LSASS MemorySub-technique	Qilin can employ an embedded Mimikatz module to dump LSASS memory.CitationPicus Qilin MAR 2025
Enterprise	T1678	Delay Execution	Qilin has the ability to delay execution.[5]
Enterprise	T1204.002	Malicious FileSub-technique	Qilin has been delivered to victims through spearphishing emails with malicious attachments.[2]
Enterprise	T1083	File and Directory Discovery	Qilin can exclude specific directories and files from encryption.[1][5]
Enterprise	T1688	Safe Mode Boot	Qilin can reboot targeted systems in safe mode to avoid detection.[1][3]
Enterprise	T1685	Disable or Modify Tools	Qilin can terminate antivirus-related processes and services.[1][2]CitationHalcyon Qilin.B OCT 2024CitationPicus Qilin MAR 2025
Enterprise	T1018	Remote System Discovery	Qilin can enumerate domain-connected hosts during its discovery phase.CitationPicus Qilin MAR 2025[4]CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Qilin has been delivered to victims through malicious email attachments.[2]
Enterprise	T1087.002	Domain AccountSub-technique	Qilin can use PowerShell cmdlets to enumerate domain users.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1490	Inhibit System Recovery	Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.[1]CitationHalcyon Qilin.B OCT 2024[4]CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1070.004	File DeletionSub-technique	Qilin can delete itself from infected hosts after execution.CitationHalcyon Qilin.B OCT 2024[4]
Enterprise	T1491.001	Internal DefacementSub-technique	Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.[4][5]CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1059.001	PowerShellSub-technique	Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.[3]CitationPicus Qilin MAR 2025 Qilin has also used PowerShell for discovery in vCenter and Active Directory environments.CitationCisco Talos Qilin Ransomware OCT 2025
Enterprise	T1219.002	Remote Desktop SoftwareSub-technique	Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.[5]

Associated objects

Groups, software, and campaigns

G1050: Water Galura

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.[1][2]

G1036: Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.0
Created: Sep 26, 2025, 19:18 UTC (UTC+00:00)
Modified: Apr 23, 2026, 03:12 UTC (UTC+00:00)
Raw hash: 09bb6c248146b4fd...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.0	Apr 23, 2026, 03:12 UTC (UTC+00:00)	Current bundle	`09bb6c248146…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.0	Apr 23, 2026, 03:12 UTC (UTC+00:00)	Older bundle	`09bb6c248146…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Trend Micro Agenda Ransomware AUG 2022
Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.
Open source URL
[2]
SentinelOne Qilin NOV 2022
SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.
Open source URL
[3]
BushidoToken Qilin RaaS JUN 2024
Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.
Open source URL
[4]
Sophos Qilin MSP APR 2025
Bradshaw, A. et al. (2025, April 1). Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream. Retrieved September 26, 2025.
Open source URL
[5]
Trend Micro Agenda Ransomware OCT 2025
Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.
Open source URL
[6]
Agenda
(Citation: Sophos Qilin MSP APR 2025)(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: SentinelOne Qilin NOV 2022)(Citation: Trend Micro Agenda Ransomware OCT 2025)
[7]
mitre-attackS1242
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use