Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026
Do Son 
At a Glance
| Malware Family | Qilin ransomware (also known as Agenda; 4.69 MB Rust-based Windows and ESXi encryptor) |
| Threat Actor | Confirmed Russian-speaking RaaS group (linked to Moonstone Sleet and Securotrop; alleged partnership with Scattered Spider) |
| Target / Victims | 179 reported attacks in 2024, over 1,000 in 2025, and over 900 in 2026; healthcare accounts for 13.3% of victims (CIS countries excluded) |
| Delivery Vector | Targeted phishing, stolen VPN and RDP credentials, vulnerable internet-facing servers, and remote-management tools |
| Key Capabilities | PowerCLI ESXi host hijacking, AES-NI and ChaCha20 file encryption, RSA-4096 key wrapping, token impersonation, symbolic-link traversal |
TL;DR
The Acronis Threat Research Unit analyzed a Rust-based Qilin ransomware build after the group claimed more than 1,000 victims in 2025. The group also claimed over 900 victims in 2026. Offering affiliates up to 85 percent of ransom payouts, the ESXi Qilin ransomware platform encrypts Windows systems, network shares, and VMware hypervisors. Furthermore, the operators publish stolen files on both a Tor blog and the clearnet WikiLeaksV2 portal to pressure victims into paying.
Delivery and Attribution
First spotted in mid-2022 under the name Agenda, the Russian-speaking group grew from 179 reported attacks in 2024 to over 1,000 claimed victims in 2025. By October 2026, the operation had claimed more than 900 additional victims while skipping organizations in Commonwealth of Independent States countries. Healthcare represents roughly 13.3 percent of confirmed targets. For instance, the group’s June 2024 attack on UK pathology provider Synnovis exposed data on 900,000 people and disrupted over 800 hospital operations. In addition, the attack caused an estimated $44 million in damages alongside a $50 million ransom demand.
Affiliates breach networks using spear-phishing emails, stolen VPN or RDP logins, unpatched public applications, and remote administration tools. In August 2025, an affiliate named “hastalamuerte” accused the core admins of withholding $48,000 during a Tox chat negotiation. The affiliate also leaked internal panel screenshots and DeepSeek AI chatbot logs.
Confirmed Versus Suspected Attribution
Confirmed attribution links Qilin ransomware deployments to both financially motivated affiliates and North Korea’s state-linked Moonstone Sleet group. Microsoft observed Moonstone Sleet deploying Qilin payloads in March 2025. Confirmed operational links also tie former Qilin members to the rival RaaS group The Gentlemen and the affiliate group Securotrop. As the Acronis Threat Research Unit report states, “Securotrop remains part of the Qilin affiliate network while operating a separate data leak site. This arrangement gives Securotrop an independent channel for publishing stolen victim data while maintaining its relationship with the wider Qilin operation.” Meanwhile, suspected attribution points to an alleged partnership between Qilin and the Scattered Spider collective.
Infection Chain
The analyzed Windows payload is a 4.69-megabyte 32-bit executable written in Rust that contains 6,598 functions and 28 command-line switches. To prevent automated sandbox analysis, the binary requires a mandatory password flag at launch. It hashes the supplied password with SHA-256 and stops immediately unless the digest matches a hardcoded 64-character value. This value also serves as the runtime mutex name.
Token Manipulation and ESXi Hijacking
When launched with administrator rights, the malware enables debug, impersonation, and base-priority privileges on its process token. Using the impersonate flag, it can also duplicate another user’s security token to access restricted network resources. Next, a worker thread stops databases, backup agents, and security services listed in its JSON configuration. The list includes Veeam, Acronis, Sophos, SAP, and Microsoft Exchange.
Next, the binary executes the CPUID instruction to check for virtual machine hypervisors and inspects registry keys for Hyper-V or Azure environments. When configured to attack virtual infrastructure, the ESXi Qilin ransomware routine runs an embedded PowerShell script. That script installs the .NET Framework and NuGet provider and modifies VMware PowerCLI settings. In addition, it disables cluster services, lists ESXi hosts, resets ESXi root passwords, enables SSH, and uploads Linux encryptors directly to the hypervisors.
System Preparation and Encryption
On Windows hosts, the malware adds a six-letter autorun registry key, enables remote-to-local and remote-to-remote symbolic-link evaluation via fsutil, and sets the EnableLinkedConnections policy to reach mapped network drives. After deleting Volume Shadow Copies with vssadmin.exe, it checks bit 25 of the CPUID output to see if the processor supports hardware-accelerated AES-NI instructions. As the researchers explained, “If they are supported, it will use AES in CTR mode as the symmetric cipher; otherwise, it will use ChaCha20.” Each file is encrypted with a random 32-byte key that is then wrapped with a hardcoded RSA-4096 public key. In addition, the ransomware skips browser folders so victims can still open the ransom chat.
Command-and-Control and Data-Exfiltration Behavior
Before running the encryptor, affiliates steal sensitive corporate files for double extortion. During encryption, the payload switches from console output to writing per-thread execution logs inside a temporary QLOG folder. Once encryption finishes, the malware packs these records into a QLOGS.zip archive for operator exfiltration.
In every affected directory, the malware drops a ransom note containing login credentials for a Tor negotiation portal. Unlike gangs that rely solely on onion sites, the operators also post stolen archives on a clearnet portal called WikiLeaksV2. As Acronis noted, “While it does not belong to the Qilin actors, the site is used to publish and distribute data stolen from organizations compromised by Qilin and its affiliates as part of the group’s double-extortion strategy.”
Defense and Detection Guidance
Because Qilin ransomware requires a command-line password argument and modifies system symbolic-link rules, defenders should monitor endpoint telemetry for fsutil behavior changes and vssadmin shadow copy deletion commands. Administrators should also restrict PowerShell and VMware PowerCLI execution, disable direct SSH access on ESXi hypervisors, and enforce phishing-resistant multi-factor authentication on all VPN and RDP gateways. Finally, as MOXFIVE and Acronis researchers recommend, organizations must maintain offline, immutable backups stored outside Active Directory trust boundaries. This ensures attackers cannot wipe recovery points before launching encryption.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
