Executive Summary

Over the past few years, Arete’s Incident Response (IR) team has responded to more than one hundred incidents attributed to the Qilin ransomware group. Active since October 2022 under a different name (Agenda), the group had an increase in activity at the beginning of 2025, especially during the second quarter, when it was the most active threat group. Notably, most of its activity came in June 2025, as the group exploited vulnerabilities in Fortinet’s FortiGate appliances and reportedly attempted to recruit ex-RansomHub affiliates. In the first quarter of 2026, the group remained the second most active extortion group behind Akira and actively targeted WatchGuard Firebox devices for initial access, particularly those vulnerable to CVE-2025-14733, a critical vulnerability in WatchGuard Fireware OS that allows a remote, unauthenticated threat actor to execute arbitrary code.

This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Qilin’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses. For more insights and data on Qilin and other top threat groups, explore Arete’s Q1 2026 Crimeware Report.

Incident Response Data on the Qilin Ransomware Group

The information below is based on Arete engagements attributed to Qilin since August 2023. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.

• Impacted sectors include professional services, public services, healthcare, financial services, manufacturing, high technology, retail, and hospitality.

• The median initial ransom demand is $400,000.

• Tools observed during investigations include Mimikatz, Lazagne, FGDump, PsExec, Splashtop, Mesh Agent, Atera, ScreenConnect Client, AnyDesk, SoftPerfect Network Scanner (Netscan), Advanced Port Scanner, WinRAR, WinSCP, FileZilla, Putty, Rclone, and MEGAsync.

• Qilin-affiliated actors often exploit edge device vulnerabilities or use legitimate credentials.

• The group operates a TOR data leak site (DLS), where it self-identifies as Qilin and commonly threatens to release stolen data if a payment is not made.

• The ransom note identifies the group as Qilin and contains links to its data leak and chat negotiation sites. To initiate negotiations, login credentials are included in the ransom note. Part of the ransom note filename matches the encrypted file extension as a naming convention.

• In addition to encrypting files and creating a ransom note, the Qilin ransomware requires a password to execute properly, supports various command-line arguments, deletes volume shadow copies, clears the Windows Event Logs, and creates a desktop wallpaper displaying information about the encryption event.

Background

Arete first observed Qilin in incident response engagements in 2023. Over time, the group evolved into an increasingly sophisticated and notable ransomware operation, becoming the top threat group in Q2 of 2025 and the second-most active, after Akira, in Q3 and Q4 of 2025 and Q1 of 2026.

TOP THREAT GROUPS OBSERVED BY QUARTER

Figure 1: Top threat groups observed by Arete by quarter

Qilin impacts a broad range of organizations throughout North America and often lists victims that fail to reach a negotiation agreement on its data leak site. The group maintains Windows and Linux versions of its ransomware, and the most recently observed Windows-based version was developed in the Rust programming language. Qilin has been observed exploiting vulnerabilities in Fortinet appliances as an initial access vector.

In 2025, Qilin broadened its RaaS platform by introducing a “Call Lawyer” negotiation-support feature, through which affiliates can request assistance from individuals that Qilin portrays as an internal legal team when victims delay or resist negotiations. The goal is to provide affiliates with tactics that pressure victims into believing that non-compliance could lead to regulatory scrutiny, fines, or even criminal exposure. Additionally, the platform offers affiliates more aggressive coercion methods, such as launching distributed denial of service (DDoS) attacks against victim websites.

Technical Analysis

Malware analysis revealed that Qilin ransomware:

• Supports multiple command-line arguments.

• Requires the correct password to fully encrypt files.

• Appends a file extension to all encrypted files; however, the extension is not static. Instead, it is randomly generated for each incident. As an example, this report uses the extension XXXXXXXXX (e.g., file.docx.XXXXXXXXX).

• Generates a ransom note with a filename that incorporates the same randomized extension value used during encryption. Continuing the example above, the ransom note was named README-RECOVER-XXXXXXXXXX.txt, where XXXXXXXXXX corresponds to the unique extension assigned in this incident.

• Self-identifies the group as Qilin in the ransom note.

• References a data leak site in the ransom note that, when accessed, also self-identifies the group as Qilin.

• Kills a list of processes and services.

• Clears Windows event logs.

• Maintains a list of whitelisted files and directories to ensure the system does not become unusable, preventing recovery when running a decryptor.

• Attempts to prevent system recovery by deleting the system's volume shadow copies.

• Creates a mutex during execution.

• Creates an image file in the %Temp% directory and later modifies a registry key to change the desktop wallpaper.

• Creates log files in a QLOG directory created in %TEMP% (e.g., ThreadId(1).LOG).

• Has a well-defined ransomware configuration with various fields like company_id, accounts, note, password_hash, directory_black_list, file_ black_list, process_black_list, and file_pattern_black_list.

Execution Pattern/Arguments

Qilin ransomware will not execute in the system without the correct “--password” argument.

Example of the command to run the executable:

Screenshot of the ransomware execution in the command prompt with the password argument redacted:

Figure 2. Ransomware execution in command prompt

List commands supported by the Qilin ransomware analyzed:

Stop Services and Processes

Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.

Process names:

Service names:

File and Directory Exclusions

The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.

Excluded file extensions:

Excluded directories:

Excluded files:

Inhibit System Recovery

Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.

The ransomware deletes volume shadow copies and disables the Windows Volume Shadow Copy Service (VSS) before file encryption by starting the following processes:    

System Network Connections Discovery

Qilin ransomware can enumerate network-mounted shares by scanning the network interfaces.

Data Encrypted for Impact

The ransomware initially finds available drives, then loads the files one by one using the Windows APIs “FindFirstFileW“ and “FindNextFileW”. The ransomware generates random AES keys to encrypt the files, then encrypts the AES keys using a public RSA key. The resulting key is placed at the end of the file. 

The ransomware encrypts files, adds a randomized extension to the encrypted files, and appends the following bytes towards the end of each file.

Figure 3. “.XXXXXXXXXX” extension added to the encrypted files

Figure 4. Encrypted file padding bytes followed by encrypted AES keys

Upon successful execution, the ransomware creates a ransom note with the file name README-XXXXXXX-XXXXXXXXXX.txt.

Figure 5. Screenshot showing a portion of the Qilin ransom note

Ransom note content:

Modify Registry

The Windows registry is a database that stores configuration settings and values for the Windows operating system. It manages user preferences, installed software, system configurations, and more. Malware abuses the Windows registry to maintain persistence, hide its presence, disable security settings, and launch malicious scripts.

The QIlin ransomware performs a registry key modification to change the desktop wallpaper.   

Figure 6. Screenshot showing the registry modification

Figure 7. Wallpaper image content from the C:\Users\%USERNAME%\AppData\Local\Temp\jjAJrgQA.jpg file

The ransomware performs the following registry key modification to achieve persistence:

Figure 8. Screenshot showing the registry modification

Mutex

The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, malware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value:  c4eed3e3a7e1114c2864980024a9c68f88e647866a180835afafd5ef80da1afe

Figure 9. Screenshot of the mutex value created while debugging the ransomware

Network Activity

The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.

Indicator Removal

Windows Event Logs keep a record of a computer's alerts and notifications, and the ransomware clears these logs to hide its malicious activity. The following command was executed to clear the logs: 

File and Directory Modification

The ransomware uses the fsutil tool to redirect file system access to a different location after gaining access to compromised networks by executing the following commands: 

Indicators of Compromise

Ransomware Configuration

Data Leak Site

The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Qilin:

TOR DLS: ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion

Figure 10. Tor DLS

Detection Mechanisms

Arete Bloktd℠ Rules

Arete Bloktd℠ includes expert threat analysis, crafted threat hunting queries, and active deployment of preventive rules for adversarial behaviors on SentinelOne® protected assets monitored by Arete.

SentinelOne® S1QL 2.0 Query Syntax

Yara

Recommended Mitigations

• Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.

• Block any known attacker C2s in the firewall.

• Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.

• Eliminate unnecessary RDP ports exposed to the internet.

• Block a high number of SMB connection attempts from one system to others in the network over a short period of time.

• Perform periodic dark web monitoring to verify if data is available for sale on the black market.

• Perform penetration tests.

• Periodically patch systems and update tools.

• Monitor connections to the network from suspicious locations.

• Monitor downloads and uploads of files to file-sharing services outside standard work hours.

• Monitor file uploads from domain controllers to the internet.

• Monitor network scans from uncommon servers (e.g., RDP server).

Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.

Arete Advisors, LLC makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the contents of this report and expressly disclaims liability for errors and omissions in the content. Neither Arete Advisors, LLC, nor its employees and contractors make any warranty, express or implied or statutory, including but not limited to the warranties of non-infringement of third-party rights, title, and the warranties of merchantability and fitness for a particular purpose, with respect to content available from this report. Arete Advisors, LLC assumes no liability for any direct, indirect, or any other loss or damage of any kind for the accuracy, completely, or usefulness of any information, product, or process disclosed herein, and does not represent that the use of such information, product, or process would not infringe on privately owned rights. Information contained in this report is provided for educational purposes only and should not be considered as legal advice.

Researchers have identified active exploitation of CVE-2026-8037, a critical unauthenticated remote code execution vulnerability affecting Progress Kemp LoadMaster. The vulnerability affects LoadMaster GA versions 7.2.63.1 and earlier and LTSF versions 7.2.54.17 and earlier and can allow a remote adversary to execute commands on an affected appliance without valid credentials when the vulnerable API is exposed. Progress has released updates addressing CVE-2026-8037 and CVE-2026-33691, a separate Web Application Firewall security control bypass, in GA 7.2.63.2 and LTSF 7.2.54.18.

The exploitation of this vulnerability reflects a broader trend of threat actors targeting internet-facing enterprise technologies. For example, Progress MOVEit Transfer experienced significant scanning and exploitation activity in 2025 involving CVE-2023-34362 and CVE-2023-36934, as well as the 2023 exploitation of CVE-2023-34362 by the Cl0p ransomware group for large-scale data theft and extortion. More recently, CISA confirmed the exploitation of SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, by ransomware groups. Collectively, these incidents demonstrate the continued targeting of perimeter-facing enterprise technologies as high-value entry points into corporate environments. 

What’s Notable and Unique 

• Public exploit research, observed exploitation attempts, and CISA KEV inclusion indicate that CVE-2026-8037 has progressed into an active operational threat, increasing urgency for organizations with exposed and unpatched LoadMaster systems. 

• Internet-facing infrastructure can be rapidly identified through automated scanning, enabling threat actors to quickly identify vulnerable systems and capitalize on newly disclosed vulnerabilities and publicly available exploit techniques. 

Analyst Comments 

CVE-2026-8037 is significant not only for its severity but also because it affects infrastructure positioned between the internet and critical enterprise applications. The combination of external exposure, unauthenticated exploitation, and public exploit research lowers the barrier for threat actors seeking initial access, and the broader threat landscape reinforces this concern. The exploitation of Progress MOVEit by Cl0p, continued scanning activity against MOVEit, and recent ransomware exploitation of SonicWall SMA1000 vulnerabilities demonstrate sustained adversarial interest in perimeter-facing enterprise technologies. These incidents indicate that such infrastructure should be treated as high-value assets within enterprise security programs.  

Sources 

• Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity 

• LoadMaster Critical Security Bulletin – June 2026 – (CVE-2026-8037, CVE-2026-33691) 

• Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

• CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.

The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls. 

What’s Notable and Unique 

• ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain. 

  
  

• To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators. 

  
  

• The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses. 

Analyst Comments 

ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites. 

Sources 

• The Evolution of ClickFix: From Cleartext to Server Side Polymorphism