ActiveVendor Research

Qilin

A Russian-speaking ransomware-as-a-service operation, formerly called Agenda, and one of the most active in 2026. It was behind the 2024 attack on NHS pathology provider Synnovis, according to the group's own data release and UK reporting.

Threat actor profile. Last reviewed 3 November 2026.

Overview

Why It Matters

The UK link is well established. NHS England confirmed the ransomware attack on Synnovis on 3 June 2024, which hit services at Guy's and St Thomas' and King's College Hospital. Former NCSC chief executive Ciaran Martin said Qilin was believed to be behind it.⁸ Qilin later published almost 400GB of data.⁹

The effects last. Researcher BushidoToken reports that on 1 June 2026 Bedfordshire Hospitals NHS Foundation Trust disclosed that patient records related to those tests were stolen, after analysis lasting more than a year. He also reads leak-site data as showing UK organisations of between £10m and £250m in revenue as the main group in the first half of 2026.¹⁰

Because affiliates run the attacks, the entry routes vary. They include Fortinet FortiGate flaws, WatchGuard Firebox devices and legitimate credentials.⁵ Affiliates get most of the ransom, up to 85% according to Acronis.⁴ Microsoft has also seen North Korea-linked Moonstone Sleet deploying it at a limited number of organisations.¹¹ Acronis says some Qilin operators have created separate operations, including The Gentlemen and Securotrop.⁴

Our View

An arrest does not stop an affiliate programme by itself, and the sources do not show that the 2026 extradition reduced activity. Plan on continued targeting of mid-sized UK organisations.

Attack Chain

How It Attacks

Combined from Arete's incident work,⁵ ATT&CK¹ and Acronis.⁴ Affiliates work differently, so treat this as a typical pattern.

1
Get In
Exploits edge devices such as FortiGate and WatchGuard Firebox, uses legitimate credentials, or sends phishing.
2
Take Credentials
Uses Mimikatz, LaZagne and FGDump.
3
Move and Install
Uses PsExec and remote tools such as Splashtop, Mesh Agent, Atera, ScreenConnect and AnyDesk, and pushes tasks through Group Policy.
4
Blind the Defences
Can reboot systems into safe mode to avoid detection, and disables security and recovery mechanisms.
5
Steal the Data
Archives and transfers with WinRAR, WinSCP, FileZilla, Rclone and MEGAsync.
6
Hit Virtualisation
Can enable SSH on ESXi hosts, change ESXi passwords and spread through vCenter.
7
Encrypt and Pressure
Deletes shadow copies, encrypts and threatens a leak. A "Call Lawyer" feature lets affiliates add people posing as a legal team.

MITRE ATT&CK

Key Techniques

Selected from the ATT&CK v20 entry for Qilin software.¹ ATT&CK has no Qilin group entry, so these describe what the software and its users have been recorded doing.

ID	Technique	Tactic	What It Looks Like
T1190	Exploit Public-Facing Application	Initial Access	Exposed applications and interfaces, including Citrix and RDP.
T1566.001	Spearphishing Attachment	Initial Access	Delivered through malicious email attachments.
T1003.001	LSASS Memory	Credential Access	Embedded Mimikatz module.
T1484.001	Group Policy Modification	Privilege Escalation	Pushes a scheduled task through a GPO.
T1021.002	SMB/Windows Admin Shares	Lateral Movement	Embeds PsExec.
T1021.004	SSH	Lateral Movement	Can enable SSH on ESXi hosts.
T1673	Virtual Machine Discovery	Discovery	Finds ESXi hosts and vCenter clusters.
T1685.005	Clear Windows Event Logs	Defense Impairment	Clears Windows logs.
T1490	Inhibit System Recovery	Impact	Deletes shadow copies and disables cluster features.
T1486	Data Encrypted for Impact	Impact	AES-256 or ChaCha20 with RSA.

Tooling

Tools Observed

Credentials

FGDumpLaZagneMimikatz

Lateral Movement and Remote Access

AnyDeskAteraMesh AgentPsExecScreenConnect ClientSplashtop

Discovery

Advanced Port ScannerSoftPerfect Network Scanner

Data Theft

FileZillaMEGAsyncPuTTYRcloneWinRARWinSCP

Observed by Arete in investigations.⁵ Many are legitimate, so check whether a tool is approved.

Vulnerabilities

CVEs tied to Qilin affiliates in the sources we opened. BushidoToken also reports exploitation of Fortinet, Check Point and WatchGuard VPN gateways, and less often SmarterMail and SolarWinds Web Help Desk, without giving CVEs for all.¹⁰

CVE-2025-14733WatchGuard Firebox. Arete says the group targeted it in the first quarter of 2026.⁵ In the CISA KEV catalogue since 19 December 2025, with known ransomware use.¹²

CVE-2024-55591Fortinet FortiOS authentication bypass. PRODAFT linked this to Phantom Mantis, then reported as Qilin, with moderate confidence.² In the CISA KEV catalogue since 14 January 2025, with known ransomware use.¹²

CVE-2024-21762Fortinet FortiOS remote code execution. PRODAFT linked this to Phantom Mantis, then reported as Qilin, with moderate confidence.² In the CISA KEV catalogue since 9 February 2024, with known ransomware use.¹²

Edge devices are the common factor. Patch them first and check whether stored credentials need resetting.

History

Key Events

2022
First appears as Agenda and rebrands as Qilin that year.¹³
June 2024
Synnovis attack on 3 June. Data published on 20 to 21 June.^8,⁹
February to March 2025
Microsoft reports Moonstone Sleet deploying Qilin since late February.¹¹
May to June 2025
PRODAFT reports Phantom Mantis, then reported as Qilin, exploiting FortiGate flaws.²
Q1 2026
Arete reports WatchGuard Firebox targeting.⁵
June 2026
Bedfordshire Hospitals disclosure on stolen records related to Synnovis tests.¹⁰
October 2026
Japan's National Police Agency confirms extraditing a 28-year-old Russian suspect to Germany on a German warrant. BleepingComputer reports him as a suspected leading member. This is an allegation, not a conviction, and reports differ on timing.^14,¹⁵

Detection

Warning Signs

From ATT&CK¹ and Arete.⁵ Treat them as prompts to check.

SSH enabled unexpectedly on ESXi hosts
ESXi password changes or disabled vSphere cluster features
Scheduled tasks pushed through new Group Policy Objects
Unapproved Splashtop, Atera, Mesh Agent or AnyDesk installs
Rclone or MEGAsync activity on servers
Machines rebooting into safe mode without a change record

What To Do

Defences That Matter

Patch and Monitor the Edge

Prioritise VPN and firewall appliances, including FortiGate and WatchGuard.^5,¹⁰
Check edge device credentials and reset those at risk after a compromise.

Vulnerability management

Tighten Identity

Require MFA for VPN and remote access.
Limit admin rights and Group Policy changes to those who need them.

Identity security and PAM

Protect Virtual Infrastructure

Restrict management access to vCenter and ESXi.
Alert on SSH being enabled on hosts.¹
Include ESXi in restore testing.

Business continuity and disaster recovery

Watch Your Supply Chain

Ask critical suppliers about their recovery plans. Synnovis showed one supplier can disrupt many hospitals.⁸
Rehearse working without a critical supplier.

Third-party and supply chain risk

Could You Keep Running if a Key Supplier Was Hit?

We can review your edge systems and supply chain risk against the methods in this profile, and then help you close the gaps.

Talk to Our Team

Evidence

Sources

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.