The Evolution of Qilin
Throughout the year 2026, the creators of Qilin (Agenda) ransomware have made fundamental changes to their malware. The initial version was an application that would require the attacker to log in, provide parameters, and enter commands manually. Further versions evolved into an automated payload that could spread through multiple user sessions automatically.
The malware authors reworked their code written in Rust into modules. They automated Active Directory scanning, implemented cross-platform spreading for VMware ESXi platforms, and used native Windows APIs to unlock database files without disrupting the service operation. The global telemetry shows these attacks being carried out against the health care, manufacturing, education, and technology sectors:
The Eight-Phase Execution Lifecycle
Laboratory execution of the baseline binary revealed eight sequential stages. The program evaluates environmental conditions at each step before mass encryption begins:
- Phase 1 (Authentication): Validates the operator-supplied SHA-256 campaign password (–password) to unlock execution.
- Phase 2 (Privilege Validation): Requests TOKEN_QUERY access via OpenProcessToken and evaluates TokenElevation (0x14).
- Phase 3 (Hypervisor Profiling): Queries CPUID Leaf 1 (hypervisor bit 31) and Leaf 0x40000000 vendor signatures, logging VMware and Hyper-V.
- Phase 4 (Crypto Negotiation): Evaluates CPUID Leaf 1 bit 25 for hardware AES-NI instructions, falling back to ChaCha20 if absent.
- Phase 5 (Config Ingestion): Parses an embedded JSON configuration blob to populate directory, extension, and service exclusion lists.
- Phase 6 (Process Termination): Spawns worker threads to stop 5 targeted Windows services and terminate 41 enterprise processes.
- Phase 7 (Mass Encryption): Traverses mounted drives and volume GUIDs, encrypting targeted files and appending a randomized extension.
- Phase 8 (Anti-Forensics & Extortion): Purges Volume Shadow Copies via vssadmin and WMIC, drops ransom notes, and rewrites the desktop wallpaper.
Password Authentication and Debugger Bypass
At the virtual address 0x005CE1EA, Qilin checks the command line parameters for the required –password parameter. The argument is hashed and compared through 32 bytes using memcmp with a hardcoded campaign hash.
In case the password parameter is wrong or missing, the process invokes ExitProcess without any error messages or artifact creation. When debugging Qilin in a tool such as x32dbg, it is possible to skip this check by placing a breakpoint at 0x005CE1FA (test eax, eax) and setting ZF=1, which allows jne to go to the main execution flow.
Cryptographic Pipeline: Dynamic Cipher Negotiation
Qilin invokes CPUID with EAX=1 and checks bit 25 of ECX for the presence of Intel AES New Instructions (AES-NI). In case of availability, it performs a loop of 14-round hardware AES-256-CTR encryption with the help of aesenc instructions. However, if there is no support for AES-NI, it resorts to ChaCha20 software-based encryption.
The file traversal takes place through a per-file decision flow which helps to improve speed without compromising the stability of the operating system. The binary performs a check against directory and extension blacklists obtained through the JSON schema embedded within it:
Qilin skips system directories (Windows, Program Files, System Volume Information) and critical extensions (.exe, .dll, .sys) to ensure the system remains bootable. For qualifying files, it uses intermittent encryption (encrypting periodic 1 MB blocks while skipping interstitial segments) to maximize throughput. It appends a randomized 10-character extension to each file, wraps the session key with an embedded RSA-4096 public key, and appends the encrypted key block to the file footer.
Enterprise Warfare, Lateral Spreading & Defense Evasion Subsystems
The October 2026 variant introduced comprehensive enterprise attack subsystems, automating network-wide lateral movement and defense evasion:
- File Lock Release via Windows Restart Manager API
In the baseline sample, open database files failed to encrypt or suffered corruption when processes were abruptly killed. In the evolved variant, Qilin integrates the native Windows Restart Manager API (rstrtmgr.dll) at address 0x0037CB07 (sub_5BCA80). It initializes a session via RmStartSession, registers locked file resources with RmRegisterResources, and cleanly terminates locking processes via RmShutdown. This enables uninterrupted encryption of SQL Server, Exchange, and virtual machine disk files.
- Embedded VMware vCenter & ESXi Hypervisor Destruction Suite
At memory offset 0x0060BC60, the evolved binary contains a modular 20.8 KB PowerShell automation suite (–spread-vcenter). It authenticates to VMware vCenter servers, disables High Availability (HA) and Distributed Resource Scheduler (DRS), extracts ESXi hypervisor IP addresses, and establishes SSH/SCP sessions. The engine uploads Linux ELF ransomware payloads to /tmp/ on discovered ESXi hosts and executes esxcli commands to power down virtual machines and encrypt .vmdk storage volumes.
- Active Directory Domain Reconnaissance & Autonomous RSAT Provisioning
Where the baseline sample required pre-installed administration tools or manual target lists, the evolved variant automates its own environment setup. At address 0x0060802C, the binary executes DISM in the background to provision the Active Directory PowerShell module (Rsat.ActiveDirectory.DirectoryServices). It then queries Active Directory via Get-ADComputer, validates domain host reachability using ICMP pings, and builds enterprise target lists automatically.
- Autonomous PsExec Lateral Spreading Subsystem
To spread across discovered domain hosts, the evolved binary embeds both 32-bit (offset 0x006E1A80) and 64-bit (offset 0x0070AC90) PsExec executables in its .rdata section. The spreading module generates remote service invocation commands, deploying itself across administrative shares (ADMIN$, C$) using harvested credentials.
- Safe Mode Reboot Loop & Kernel EDR Neutralization
To neutralize third-party endpoint detection and response (EDR) sensors that do not load in Safe Mode, the evolved sample manipulates the Boot Configuration Data: bcdedit.exe /set {current} safeboot minimal (or safeboot network). It updates the Windows Registry (Winlogon\AutoAdminLogon) to trigger an automated reboot into Safe Mode, where encryption proceeds without driver interference.
- Network Printer Ransom Note Bombing Subsystem
To maximize visibility and executive pressure, the evolved sample includes a dedicated raw printing module (shared/printing/src/printers.rs). It scans local network subnets for TCP Port 9100 (RAW print/JetDirect) and sends cleartext ransom notes directly to office network printers, physically generating hardcopy ransom demands.
- Complete 42-Switch Enterprise Command-Line Interface
The 6 basic command-line arguments in the baseline expanded into a 42-switch management structure. Operators can fine-tune thread concurrency (–cpu-threads), network timeouts (–timeout), printer note delivery (–printer), Safe Mode configuration (–safe-mode), and ESXi targeting (–spread-vcenter).
- Autonomous Anti-Forensic Self-Deletion
Upon completing encryption, the evolved sample unlinks its binary from disk using: cmd.exe /C timeout /T 10 & Del “<payload_path>”. This unlinks the executable and deletes temporary runtime logs before incident response teams can preserve volatile artifacts.
Technical Progression: March 2026 vs. October 2026
The following matrix summarizes the architectural evolution observed across both analyzed Qilin samples:
Table 1. Qilin Technical Comparison: March 2026 vs. October 2026
| Capability / Feature | March 2026 Baseline (sample2.exe) | October 2026 Evolved (resmon.exe) |
| Binary Stance & Masquerading | Unsigned, naked PE32 binary (sample2.exe / wg.exe) | Forged Microsoft Code Signing PCA 2011 signature overlay; masquerades as resmon.exe |
| Source Architecture | Monolithic Rust binary | Modular Rust workspace (22 internal crates across shared/ and spreading/) |
| Process Token Exploitation | Single-session process token (SeDebugPrivilege) | Multi-session SID enumeration across HKEY_USERS with DuplicateTokenEx |
| File Handle Release | Brute-force TerminateProcess & sc stop | Native Windows Restart Manager API (rstrtmgr.dll) |
| Active Directory Recon | Manual; requires pre-installed RSAT tools | Automated background DISM installation of RSAT tools + Get-ADComputer |
| ESXi Lateral Movement | Static PowerShell script template | Modular 20.8 KB vCenter/ESXi spreading engine with SCP payload staging |
| Safe Mode Manipulation | Absent, runs in standard user session | Enforces Safe Mode reboot via bcdedit /set safeboot and AutoAdminLogon |
| Ransom Note Delivery | Drops README.txt notes; updates user desktop wallpaper | Drops notes, updates wallpaper, and prints across network printers via Port 9100 |
Double-Extortion Portal
Qilin operates a double-extortion ransomware-as-a-service (RaaS) model. Encrypted systems receive a ransom note containing a 64-character victim token and an onion portal URL:
Affiliates manage ransom negotiations through this portal. When victims refuse to negotiate, the operators publish the stolen data on their leak site, listing company revenue, employee counts, and download links for exfiltrated records.
Seqrite / Quick Heal Detection Coverage
Detection of both Qilin strains is possible using static and behavior-based signatures, such as bcdedit Safe Mode modification and rstrtmgr.dll process termination.
Detection name:
Ransom.Qilin.S40227353
Trojanransom.Generic
Access the Full Technical Whitepaper
Access the complete technical whitepaper containing MITRE ATT&CK mapping, indicators of compromise, dynamic execution screenshots, cryptographic analysis of the unrolled AES-256 hardware pipeline, and privilege escalation traces.
