iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Qilin, also known as Agenda, is a ransomware-as-a-service (RaaS) operation first observed in 2022. Its affiliates can steal data, encrypt systems and threaten to publish or sell what they took. Because affiliates choose different entry methods and tools, there is no single Qilin attack sequence to memorize. The most reliable defenses are reducing exposed access, protecting identities, maintaining offline and tested backups, and rehearsing a response that covers both unavailable systems and stolen information.
This guide explains what is established about Qilin, how reported incidents unfolded, and the practical controls that matter to a small business or IT team.
What is Qilin ransomware?
Qilin (Agenda) is a ransomware-as-a-service operation. The core group supplies malware, infrastructure and other services; affiliates recruit victims and conduct intrusions. The Center for Internet Security (CIS) describes Qilin as first observed in 2022.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Qilin uses a double-extortion model. An affiliate can first copy sensitive files and then encrypt systems, leaving the victim facing two threats: loss of access to business data and possible disclosure or sale of the stolen material. A decryption key, even if obtained, would not remove the data-leak threat.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
RaaS explains why reports do not look identical. One affiliate may phish an employee, another may exploit an unpatched internet-facing application, and another may buy or steal credentials for a remote-access portal. Tools, dwell time, targets and negotiation behavior can differ. Treat incident reports as examples of Qilin activity, not as a mandatory playbook every affiliate follows.
What the reported figures mean
CIS counted 29 Qilin incidents reported to the U.S. Multi-State Information Sharing and Analysis Center (MS-ISAC) between December 2023 and June 30, 2025. That is a defined set of state, local, tribal and territorial (SLTT) reports, not a worldwide incident count. Fifty-five percent of those reports occurred in the second quarter of 2025.
Within the same MS-ISAC reporting population, Qilin accounted for 24% of reported SLTT ransomware incidents in Q2 2025, compared with 9% in Q1 2025. CIS also reported ransom demands as high as $500,000; one case involving that demand was refused. The figure is a highest reported demand in that profile, not an average or a prediction for a particular victim.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow does Qilin ransomware work?
The broad pattern is data theft plus disruption, but the order and techniques vary. A typical affiliate must obtain access, expand control, find valuable systems and data, remove or disable recovery options, exfiltrate files, and deploy encryption. Some affiliates may skip steps, combine them, or use different tools.
Access and foothold
CIS lists phishing, exploitation of public-facing applications and external remote services such as Remote Desktop Protocol among reported initial-access paths. Weak passwords, excessive privileges and unprotected remote administration increase the consequences of any successful entry.
Discovery and privilege expansion
After entry, operators look for domain controllers, file servers, endpoint-management systems, backup infrastructure and high-value data. They may create additional administrator accounts, move laterally and use legitimate administration tools so their activity resembles normal IT work.
Data theft and pressure
In a double-extortion attack, files are gathered before or during encryption and uploaded to infrastructure controlled by the criminals. The victim is then pressured to pay to restore access and to prevent publication or sale. Restoring from backups addresses only the encryption portion; it does not erase copies already exfiltrated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Encryption and anti-recovery actions
In a 2025 incident analyzed by Sophos, the Qilin-affiliated deployment stopped and disabled Volume Shadow Copy Service, deleted shadow copies and Windows event logs, enumerated hosts, changed the desktop wallpaper and deleted itself after execution. Those behaviors were observed in that incident and should not be treated as universal Qilin requirements.
How does Qilin get into a network?
There is no single reliable entry route. The following examples show why controls must cover people, internet-facing systems, identity and suppliers.
Phishing an administrator at an MSP
Sophos documented a 2025 campaign against a managed service provider (MSP). An affiliate sent an administrator a fake ScreenConnect security alert. A lookalike site captured the administrator’s password and a time-based multifactor authentication (MFA) code. The attacker then entered the MSP’s remote-management environment and deployed a separate ScreenConnect instance across managed customers.
From there, the operators performed discovery and credential actions, collected customer files with WinRAR, uploaded archives to EasyUpload, targeted backups and deployed Qilin across multiple customer environments. The incident demonstrates the blast radius of a supplier or MSP connection: one compromised management plane can expose many downstream organizations. It does not establish that every Qilin affiliate uses ScreenConnect, WinRAR or EasyUpload.
Compromised credentials and a VPN without MFA
In a separate incident observed in July 2024, Sophos reported that attackers used compromised credentials to enter a VPN portal that lacked MFA. They moved laterally to a domain controller, changed Group Policy to run scripts that harvested credentials stored in Chrome on endpoints, exfiltrated the credential files, deleted them, cleared logs and encrypted systems. The browser-credential theft was an incident-specific technique, not a defining feature of every Qilin deployment.
Phishing that grants excessive privilege
CIS describes an MS-ISAC-reported SLTT incident in which a phishing link led to a user account protected by a weak password and given unnecessary administrative access. Attackers created new administrator accounts and encrypted data across the network. Least privilege and strong authentication would have limited what that first account could do.
How can I protect my business from ransomware?
Protection is a layered program rather than a single product. Prioritize controls that close common entry points, limit the damage of a stolen account and make recovery independent of the attacker.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Patch every internet-facing and business-critical system
Apply security updates to operating systems, applications, firmware, firewalls and VPN appliances promptly. The UK National Cyber Security Centre (NCSC) recommends installing updates as soon as they are available and enabling automatic updates where practical. Maintain an inventory so that an abandoned appliance or forgotten server does not remain exposed.
- Track versions and end-of-support dates for public-facing applications.
- Remove or restrict services that are not required, especially remote administration exposed directly to the internet.
- Use a documented emergency process for critical vulnerabilities when normal change windows are too slow.
- Verify that patches actually installed and that affected services restarted safely.
Harden identity, administrator and remote access
Require MFA for VPNs, cloud administration, email, remote-management tools and other privileged access. Prefer phishing-resistant methods such as FIDO2 security keys where feasible. Sophos recommends phishing assessments, conditional access limited to managed devices and blocking or flagging messages that fail DMARC checks.
MFA reduces risk but is not a guarantee. Real-time adversary-in-the-middle phishing can relay some one-time codes and session information. Train administrators not to approve unexpected prompts, require number matching or stronger methods where available, and review sign-in alerts for impossible travel, unfamiliar devices and unusual locations.
- Use separate administrator accounts rather than giving daily user accounts global privileges.
- Apply least privilege and time-limited elevation for administrative tasks.
- Rotate passwords and tokens after suspected phishing or staff departure.
- Disable dormant accounts and review service-account permissions.
- Restrict MSP and vendor access to approved systems, times and named personnel; log and review that activity.
Reduce phishing success
Teach staff how to verify urgent security notices, password-reset requests and file-sharing invitations without using links in the message. Run controlled phishing assessments for learning, not punishment. Configure mail authentication and inspect lookalike domains. Administrators and help-desk staff deserve extra training because a single captured session can expose many customers.
Segment systems and protect management planes
Separate user endpoints, servers, domain controllers, backup systems and management tools with network controls. An endpoint account should not be able to reach every server or delete backup sets. Restrict east-west traffic, require administrative jump hosts where appropriate and alert on new domain administrators, unexpected Group Policy changes, mass file access and shadow-copy deletion.
Recommended Free Tools
Use defense in depth and prepare to contain an intrusion
The NCSC recommends assuming that some malware may get through and preparing for detection, containment and recovery. Keep endpoint, identity, network and cloud logs in a location an intruder cannot easily erase. Define who can isolate a device, disable an account, revoke tokens and disconnect a site. Practice those actions so that an overnight alert does not become a negotiation over basic authority.
Backups that survive a Qilin attack
The NCSC calls up-to-date backups the most effective way to recover from ransomware. The FBI likewise recommends regular, verified backups kept separate from the systems they protect. A backup that is always writable from the production domain may be encrypted or deleted along with the primary data.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Compare backup designs
| Design choice | More resilient approach | Higher-risk approach |
|---|---|---|
| Isolation | Offline, immutable or otherwise protected copies that production credentials cannot immediately delete | A backup share or device permanently connected with the same administrator credentials as production |
| Copies and locations | Multiple copies across separate media, services or physical locations | One device or one cloud account that represents the only copy |
| Recovery confidence | Scheduled restoration drills using known-clean recovery equipment and documented recovery times | Backups that have never been restored or whose permissions and contents are unknown |
| Account protection | Separate backup identities, MFA and restricted deletion rights | Shared administrator passwords and unrestricted deletion from ordinary workstations |
| Operational scope | Coverage for endpoints, identity systems, servers, cloud services, remote access and MSP connections | Endpoint files only, with no plan for domain controllers, SaaS data or configuration recovery |
Build and test the plan
- List the systems and data the organization must restore first, such as identity, DNS, finance, production applications and customer records.
- Create multiple backup copies using more than one storage location or solution. Keep at least one copy offline or protected against online deletion.
- Disconnect external hard drives and USB backup devices when a backup job is complete; the NCSC specifically warns against leaving them permanently connected to the network.
- Protect cloud backup versions from immediate deletion by a compromised production administrator. Use separate accounts, retention locks or equivalent controls where supported.
- Test restoration on a schedule. Record how long each system takes, what credentials are needed and whether restored data is complete and usable.
- After an incident, rebuild or validate identity and management systems before reconnecting ordinary endpoints, and restore from backups whose integrity and date are known.
An external drive can be useful for an offline copy, but it is only one component of a resilient design. Separate copies, protected accounts and tested restoration matter more than the brand or capacity of a single device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if Qilin is suspected
Move quickly, but preserve evidence. A rushed shutdown or cleanup can destroy information needed to understand the entry point and determine whether data was stolen.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Activate the incident plan. Name an incident lead, technical lead, legal or privacy contact and communications owner. Use a communication channel that is not dependent on the potentially compromised environment.
- Contain access. Isolate affected endpoints and servers, disable suspected accounts, revoke sessions and tokens, and restrict VPN, remote-management and MSP connections as necessary. Avoid deleting attacker artifacts before responders collect them.
- Protect remaining backups. Disconnect removable media, lock down backup administration and preserve clean copies. Do not let a compromised domain account continue to manage backup jobs.
- Determine the scope. Identify encrypted systems, stolen credentials, persistence, lateral movement and evidence of exfiltration. Check logs from identity providers, VPNs, firewalls, cloud services and management tools.
- Use qualified incident responders. They can help with forensics, containment, restoration sequencing and communications. In the UK, the NCSC describes a commercial scheme for certified incident-response companies; verify current certification and regional availability before engaging any provider.
- Report and meet obligations. U.S. victims can contact a local FBI field office or report through the FBI’s ransomware guidance and IC3 route. UK organizations can use the NCSC incident-reporting route and Report Fraud. Privacy, regulatory and contractual notification deadlines depend on jurisdiction and the data involved.
Should you pay a ransomware ransom?
The FBI does not support paying a ransom and warns that payment does not guarantee the return of data. Its guidance states: “Paying a ransom doesn’t guarantee you or your organization will get any data back.” The NCSC likewise says payment cannot guarantee access, leaves the computer infected, funds criminal groups and may make a victim more likely to be targeted again.
Payment also does not resolve the stolen-data problem. Criminals may keep copies, demand more money or fail to honor a promise not to publish. Refusing payment is not a guarantee of recovery either, so the practical priority is containment, evidence preservation, legal advice, restoration and transparent communication. Consider sanctions, law-enforcement guidance, insurance conditions and reporting duties before any decision.
Can Qilin ransomware files be decrypted?
No current, guaranteed Qilin-specific decryptor is established by the guidance cited here. The NCSC says files encrypted by most ransomware typically cannot be decrypted by anyone other than the attacker. The NCSC recommends checking the No More Ransom Project, which may have a tool for some ransomware families and versions.
Do not promise that a consumer utility will recover Qilin-encrypted files. Preserve encrypted samples and ransom notes, work with qualified responders, and check reputable official decryption resources. Even a successful decryptor would not address data that was copied before encryption, so investigate exfiltration separately.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Planning questions to settle before an incident
- Which person can authorize isolation of a site, domain account or MSP connection outside business hours?
- Where are the offline or immutable backups, and who can access them without the production domain?
- What is the restoration order for identity, networking, critical applications and data?
- Which customers, regulators, insurers, law-enforcement contacts and suppliers must be notified?
- How will the organization operate if email, file shares and customer systems are unavailable?
- When was the last restoration drill, and what failed during it?
Exercise the answers with a tabletop scenario. Update contact lists, recovery instructions and access credentials after staff, suppliers or systems change.
Bottom line
Qilin is a flexible affiliate-driven ransomware operation, not a single virus with one predictable route. Reduce the chance of entry with rapid patching, restricted remote access, least privilege, strong and phishing-resistant authentication, segmentation and phishing defenses. Assume that encryption may be accompanied by data theft. Maintain multiple protected backups, disconnect removable media, test restoration and rehearse containment and reporting. Those measures improve your odds whether the next affiliate arrives through phishing, a vulnerable public service, a stolen password or a supplier connection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
