iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Isolate affected systems, activate your incident-response plan, preserve evidence, and establish what was encrypted, stolen, or still accessible. Qilin (also called Agenda) operates as a ransomware-as-a-service program. Its affiliates’ methods differ, so a ransom note or leak claim cannot tell you the full scope of your incident. Treat encryption, possible data theft, and continuing unauthorized access as separate questions.
Use CISA’s general ransomware response guidance for the sequence below, while treating the Qilin-specific observations as a threat profile rather than proof of what happened in your environment.
What should we do first after a Qilin ransomware attack?
The first objective is to stop further damage without destroying evidence. Follow the organization’s approved incident-response plan and assign one incident commander who can make containment decisions and keep leadership informed.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Convene the response team
Bring together security, IT operations, executive leadership, legal and privacy advisers, communications, business-continuity owners, cyber-insurance contacts, and critical service providers as appropriate. Define who can authorize network isolation, public statements, restoration, and any contact with the extortionist. Use an out-of-band channel—such as phone calls or a separate messaging system—where feasible. An intruder may monitor normal email or collaboration systems and react when it sees that defenders have detected the attack.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
2. Isolate affected systems immediately
Determine which endpoints, servers, virtual machines, storage systems, and network segments show encryption, suspicious logins, security-tool alerts, or other indicators. Disconnect affected devices from wired and wireless networks, shared storage, and remote-access paths. If several systems or subnets appear involved, responders may need to take the network offline at the switch level rather than isolating machines one by one.
Containment must be coordinated. Disconnecting a domain controller, hypervisor, backup server, or clinical, industrial, or public-safety system without understanding dependencies can create a separate outage. Record each isolation action, its time, the person who approved it, and the asset affected.
3. Decide carefully before powering anything down
Powering down a computer can stop encryption or lateral movement when no safer disconnection method exists, but shutdown can destroy volatile evidence held in memory and temporary buffers. Prefer network isolation, account disablement, or other controlled containment when responders can do so safely. If shutdown is unavoidable, document why it was necessary and preserve the device for forensic handling.
4. Preserve cloud and virtual infrastructure evidence
When appropriate, preserve cloud-volume snapshots and relevant virtual-machine state before making changes. Snapshots are not automatically clean backups; treat them as potential evidence until examined. Avoid deleting compromised accounts, storage volumes, or logging resources merely to “clean up” the environment.
How should we preserve evidence and investigate the scope?
Ransomware encryption may be the visible end of an intrusion that began days or weeks earlier. Investigate whether the adversary still has access, deployed additional malware, created persistence, or copied data before launching encryption.
Collect volatile and durable evidence
- Capture system memory from representative live systems when feasible and safe.
- Preserve Windows Security logs, authentication records, endpoint telemetry, firewall buffers, VPN and remote-access logs, cloud audit trails, and identity-provider events.
- Maintain forensic images of key systems and retain samples of precursor malware, ransom notes, scripts, and indicators.
- Record hostnames, IP addresses, user accounts, timestamps, encryption extensions, affected shares, and the sequence in which systems failed.
- Protect copies from alteration and keep a chain-of-custody record if litigation, regulatory review, or law-enforcement action is possible.
Centralized logs may have been deleted or tampered with. Compare multiple sources—endpoint, network, identity, DNS, email, firewall, and cloud records—to reconstruct activity. Review detections for devices that are not yet encrypted; an unaffected machine is not necessarily uncompromised.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Separate four scope questions
- Which systems were encrypted? Map hosts, applications, file shares, databases, backups, and removable media that cannot be accessed.
- Which systems were accessed or altered? Look for new accounts, privilege changes, remote tools, scheduled tasks, unusual administrator activity, and disabled security controls.
- Could data have been exfiltrated? Examine outbound transfers, archive creation, cloud-storage activity, unusual compression, and connections to infrastructure associated with the intrusion.
- Does the adversary retain access? Hunt for persistence, valid credentials, exposed remote services, web shells, and unremoved malware before reconnecting systems.
Keep these questions distinct. A system can be encrypted without evidence that its data was copied, while another system may have been accessed or exfiltrated from without being encrypted.
Interpret Qilin claims cautiously
The Center for Internet Security (CIS) describes Qilin as a double-extortion ransomware-as-a-service operation first observed in 2022. Double extortion generally means an operator threatens both disruption through encryption and disclosure of stolen information. CIS reports a high likelihood of data theft in Qilin attacks, but that threat profile does not prove that data was taken from your organization.
Affiliates use different techniques. Reported entry routes include phishing, exploitation of public-facing applications, and external remote services. Do not assume one of those routes was used in your case until logs and forensic evidence support it. Do not treat a leak-site listing, a ransom note, a file sample, or an attacker’s claimed volume of stolen data as independently verified evidence.
Who should we notify?
Internal and contractual notifications
Keep management updated through the incident commander and use the authorized communications lead for employee, customer, partner, and media statements. Legal and privacy teams should determine whether personal, health, financial, regulated, or confidential business information may be involved. Review cyber-insurance notice requirements, contractual reporting clauses, service-provider obligations, and continuity commitments.
Notification deadlines and required contents depend on the organization, affected data, and jurisdiction. The available general guidance does not establish a universal deadline, so obtain current jurisdiction-specific advice rather than applying a generic timetable.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Government and law-enforcement reporting
Report the incident to CISA, the local FBI field office, or the FBI’s Internet Crime Complaint Center (IC3), as appropriate. Share useful indicators, timelines, ransom notes, wallet information, malware samples, and evidence of exfiltration when law enforcement can accept them. CISA’s #StopRansomware Guide states: “Should your organization be a victim of ransomware, follow your approved IRP.” Its checklist is general ransomware guidance, not a Qilin-specific playbook.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
For U.S. state, local, tribal, and territorial entities, CIS identifies MS-ISAC as a source of additional threat intelligence. CIS reported that MS-ISAC membership became fee-based on June 23, 2025; confirm current eligibility and terms directly before relying on membership or any associated service.
Should we pay the Qilin ransom?
The FBI says it does not support paying ransom and recommends contacting a local FBI field office or filing an IC3 report. Payment does not guarantee a working decryptor, deletion of stolen data, or an end to further extortion. It can also fund additional attacks and may create sanctions, legal, accounting, or insurance complications.
Do not make a payment decision from the ransom note alone. A defensible decision requires leadership, legal, incident-response, insurance, and law-enforcement input, along with a documented assessment of:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- the services and safety functions that are unavailable;
- the integrity and recovery time of backups and alternate operating procedures;
- evidence of data theft and the resulting notification or harm obligations;
- the risk that the attacker still has access;
- sanctions and other legal restrictions applicable to the transaction; and
- whether a law-enforcement or trusted specialist has identified a legitimate decryptor for the specific sample.
CISA advises consulting federal law enforcement about possible decryptors even while mitigation is under way. Never assume a decryptor advertised by an unknown party is safe; test any tool on forensic copies in an isolated environment and preserve the original encrypted data.
How can we tell whether Qilin stole our data?
No ransom demand, leak threat, or claimed file count establishes exfiltration by itself. Build an evidence-based assessment:
- Identify the accounts and systems the intruder could reach, including file servers, databases, cloud storage, email, and backup infrastructure.
- Review outbound network flows, proxy records, firewall logs, cloud audit trails, endpoint telemetry, and unusual archive or compression activity for the period before encryption.
- Search for staging directories, recently created archives, bulk reads, unusual use of legitimate cloud-storage tools, and transfers outside normal business patterns.
- Classify potentially exposed information—such as personal, health, payment, government, customer, source-code, or trade-secret data—and preserve the evidence supporting each conclusion.
- Compare attacker claims with observed filenames, timestamps, and samples, but label unverified claims as claims.
If logs are incomplete, say what the evidence can and cannot establish. “No evidence found” is not the same as proof that no data left the environment.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How do we restore systems safely?
1. Set restoration priorities by business dependency
Rank services by safety, legal duty, revenue, public impact, and operational dependency. Map identity, DNS, networking, virtualization, storage, applications, and data flows before choosing an order. A universal sequence does not work for every organization: restoring an application before its identity provider, database, or network dependencies can prolong the outage or recreate access for the attacker.
Recommended Free Tools
2. Validate backup sources
Use offline, encrypted backups that predate the compromise when possible. Verify that backup copies are available, complete, and restorable; check that backup credentials and management consoles were not compromised. CISA recommends maintaining offline, encrypted backups and regularly testing both availability and integrity.
An encrypted external hard drive can be one physical component of an offline backup workflow, but a drive alone is not a resilient organizational backup design. Maintain appropriate copies, access controls, geographic separation, retention, and restoration tests for the organization’s risk profile.
3. Build a clean recovery environment
Restore into a clean environment or recovery VLAN. Permit only assessed, remediated systems to join it. Rebuild or reimage compromised hosts rather than trusting that deleting encrypted files removed persistence. Reset exposed credentials, enforce multifactor authentication where available, patch exploited public-facing applications, remove unauthorized remote tools, and close the entry path identified by the investigation.
4. Test before production reconnection
Restore a representative service first and verify authentication, application behavior, data integrity, logging, endpoint protection, and network segmentation. Check that restored systems do not contact suspicious infrastructure or show the same indicators. Reconnect in controlled waves, monitor continuously, and keep an alternate operating procedure available in case encryption resumes.
5. Capture lessons and share indicators
After stabilization, document the timeline, decisions, evidence gaps, control failures, recovery times, and improvements. Share relevant indicators with CISA or an appropriate sector information-sharing group when permitted. Update the incident-response plan, backup design, logging coverage, privileged-access controls, and exercises based on what the incident demonstrated.
What is known about Qilin’s activity?
The following figures come from CIS reporting to MS-ISAC and apply only to the stated U.S. SLTT reporting population and periods. They are not global prevalence estimates or current 2026 counts.
| Measure | Reported figure | How to interpret it |
|---|---|---|
| Share of U.S. SLTT ransomware incidents attributed to Qilin in Q2 2025 | 24% | CIS compared this with 9% in Q1 2025; the measure covers incidents reported to MS-ISAC, not all ransomware attacks. |
| Qilin incidents reported by U.S. SLTT entities, December 2023–June 30, 2025 | 29 | CIS said 55% of those reports arrived in Q2 2025. |
| Example ransom demand | $500,000 | One observed incident in which the victim refused; it is not a typical or established amount for every case. |
| Example exfiltration claim | Up to 500 GB | An amount claimed in some incidents; it is not independently established for every victim. |
CIS’s CTI team wrote on September 11, 2025, that “In Quarter 2 (Q2) of 2025, Qilin became the most active ransomware targeting U.S. State, Local, Tribal, and Territorial (SLTT) government entities, with nearly a quarter of all incidents attributed to its operation.” The statement describes that reporting population and quarter; it should not be generalized to every sector or geography.
Quick Recap
Operational checklist for incident leaders
- Activate the approved incident-response plan and name an incident commander.
- Move coordination to channels the intruder is unlikely to monitor.
- Isolate affected hosts, subnets, shares, remote access, and backup infrastructure.
- Document containment actions and avoid unnecessary shutdowns that could erase memory evidence.
- Preserve images, memory, logs, cloud snapshots, ransom notes, malware, and indicators.
- Determine encryption, unauthorized access, possible exfiltration, and remaining persistence separately.
- Notify leadership, legal/privacy, insurers, communications, providers, CISA, and law enforcement as appropriate.
- Make any ransom decision only after legal, operational, and law-enforcement review.
- Restore critical services from clean, offline, encrypted, tested backups in a controlled environment.
- Reset credentials, remove persistence, close the entry path, monitor restored systems, and record lessons learned.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
