qilin

T1078Valid Accounts

Compromised credentials used to authenticate via VPN and RDP. Qilin notably steals credentials from Chrome browsers on compromised endpoints before encryption.

T1190Exploit Public-Facing Application

Exploitation of vulnerabilities in VPN appliances and remote management tools to gain initial access.

T1566Phishing

T1566.003Phishing: Spearphishing via Service

Qilin affiliates spear-phished MSP administrators via ScreenConnect to gain access to downstream customers. Phishing campaigns using credential-harvesting pages targeting VPN and SSO portals.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell scripts used for payload execution, lateral movement, and post-exploitation tasks.

T1059.004Command and Scripting Interpreter: Unix Shell

Shell scripts used to execute the Linux/ESXi variant of the Qilin ransomware payload.

T1569System Services

T1569.002System Services: Service Execution

T1037Boot or Logon Initialization Scripts

T1053Scheduled Task/Job

T1053.005Scheduled Task/Job: Scheduled Task

Scheduled tasks created to maintain persistence and execute post-exploitation scripts.

T1098.004Account Manipulation: SSH Authorized Keys

T1136Create Account

T1547Boot or Logon Autostart Execution

T1068Exploitation for Privilege Escalation

T1027Obfuscated Files or Information

Qilin.B variant (October 2024) introduced enhanced obfuscation and anti-analysis techniques compared to earlier versions.

T1036.001Masquerading: Invalid Code Signature

T1134.004Access Token Manipulation: Parent PID Spoofing

T1211Exploitation for Defense Evasion

T1480Execution Guardrails

T1497.001Virtualization/Sandbox Evasion: System Checks

T1553.002Subvert Trust Controls: Code Signing

T1562.001Disable or Modify Tools

Security tools and EDR solutions disabled via batch scripts and Group Policy modifications.

T1562.004Impair Defenses: Disable or Modify System Firewall

T1564Hidden Artifacts

T1564.003Hidden Artifacts: Hidden Window

T1003.001OS Credential Dumping: LSASS Memory

LSASS memory dumped to harvest credentials for lateral movement and privilege escalation.

T1040Network Sniffing

T1110.002Brute Force: Password Cracking

T1555.003Credentials from Web Browsers

Qilin notably deployed a custom script to steal credentials stored in Google Chrome browsers on all domain-joined machines via Group Policy — a distinctive TTP first observed in the Synnovis NHS attack (June 2024).

T1012Query Registry

T1046Network Service Discovery

Network scanning used to enumerate hosts and services within the victim environment.

T1082System Information Discovery

System information collected to tailor the attack and identify high-value targets.

T1614System Location Discovery

T1021Remote Services

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement across victim networks.

T1021.002Remote Services: SMB/Windows Admin Shares

SMB used to propagate payloads and move laterally within the network.

T1021.004Remote Services: SSH

T1570Lateral Tool Transfer

T1560.001Archive Collected Data: Archive via Utility

Data compressed and archived prior to exfiltration.

T1602.002Network Device Configuration Dump

T1011Exfiltration Over Other Network Medium

T1011.001Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth

T1048.003Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Data exfiltrated to cloud storage and actor-controlled servers for double extortion via the Qilin leak site.

T1001Data Obfuscation

T1001.001Data Obfuscation: Junk Data

T1071.001Application Layer Protocol: Web Protocols

C2 communication over HTTPS; Tor used for victim portals.

T1572Protocol Tunneling

T1486Data Encrypted for Impact

Qilin (formerly Agenda) uses ChaCha20 for file encryption with RSA-4096 for key protection. Originally written in Go, later rewritten in Rust (Qilin.B). Targets Windows, Linux, and VMware ESXi. Notable attack: Synnovis NHS pathology services (June 2024) causing 10,000+ NHS appointment cancellations. Active RaaS with high affiliate revenue share.

T1490Inhibit System Recovery

Shadow copies deleted; ESXi snapshots removed to prevent VM recovery.

T1561Disk Wipe

T1561.001Disk Wipe: Disk Content Wipe

T1587.001Develop Capabilities: Malware

T1590.004Gather Victim Network Information: Network Topology