Threat Advisory • Attack Report

Qilin Rising: Continued Global Dominance and Expanded Tradecraft

Qilin ransomware (aka Agenda, Water Galura, Phantom Mantis, Gold Feather) remains the world's most active ransomware operation, holding the top global ranking for three consecutive quarters through Q1 2026 with over 1,800 cumulative victims, a matured triple-extortion model combining DDoS and a "Call Lawyer" negotiation feature, and demonstrated pre-disclosure exploitation of CVE-2025-31324.

---

Section 01

Summary

First active in July 2022, Qilin ransomware — also tracked as Agenda, Water Galura, Phantom Mantis, and Gold Feather — has emerged as the world's most active ransomware operation, holding the top global ranking for three consecutive quarters through Q1 2026. Qilin ransomware recorded over 330 leak-site victims in a single quarter, a figure exceeding the combined output of the bottom fifty ransomware groups, and a cumulative count exceeding 1,800 victims by late May 2026. Qilin ransomware targets Windows, Linux, and VMware ESXi environments across nearly every industry vertical — including Business Services & Consulting, Manufacturing, Healthcare, Retail, Financial Services, Legal, Real Estate, Technology, Government, Education, Hospitality, Transportation, Food Service, Agriculture, Insurance, Media, Associations, Energy, and Charitable Organizations — on a global scale, with the notable exception of CIS countries.

Qilin ransomware has matured into a fully developed triple-extortion model that layers distributed denial-of-service (DDoS) pressure and a "Call Lawyer" negotiation feature on top of traditional file encryption and data-leak threats. Qilin ransomware affiliates have also demonstrated zero-day exploitation capability, weaponizing the SAP NetWeaver Visual Composer vulnerability CVE-2025-31324 roughly three weeks before public disclosure. Despite the July 2025 departure of top affiliate "Hastalamuerte" — who launched the rival ransomware-as-a-service (RaaS) brand The Gentlemen — and the FBI's January 2026 seizure of the RAMP underground forum, Qilin ransomware has continued absorbing displaced affiliates from disrupted operations such as BlackSuit and 8Base, cementing Qilin ransomware's position as the dominant global ransomware threat heading into the remainder of 2026.

---

Section 02

Attack Details

Exploited CVEs

#1 — Unmatched Dominance in the Ransomware Ecosystem

Qilin ransomware has solidified its position as the most active ransomware operation in the world, holding the top global ranking for three consecutive quarters through Q1 2026 with over 330 leak-site victims in a single quarter and a cumulative count exceeding 1,800 by late May 2026. This dominance reflects a broader consolidation of the ransomware ecosystem, in which the top ten groups now claim roughly 71% of all victims — a sharp reversal from the fragmented landscape of 2025. Qilin ransomware has been the principal beneficiary of this consolidation, absorbing displaced affiliates following the disruption of BlackSuit, 8Base, and weakened mid-tier operators, while maintaining operational consistency in negotiations and decryption to preserve its standing across the affiliate economy. Recent confirmed Qilin ransomware victims listed on its Tor leak site span dozens of organizations worldwide, including clinicamaitenes.cl and novajoy.com, among more than forty other publicly disclosed breaches.

#2 — Hastalamuerte's Departure and the Rise of The Gentlemen

A significant structural event occurred in July 2025 when "Hastalamuerte," Qilin's most prolific affiliate and a veteran operator previously associated with Embargo, LockBit, and Medusa, departed the program following a public payment dispute on the RAMP underground forum. Hastalamuerte subsequently launched The Gentlemen as an independent RaaS brand, taking with him an inventory of approximately 14,700 pre-compromised FortiGate devices and roughly 20 experienced operators. Despite this loss, Qilin ransomware has retained its market position by continuing to recruit displaced affiliates from disrupted programs and refining its locker tooling, demonstrating the resilience of Qilin's core infrastructure and brand reputation.

#3 — Triple-Extortion Model with DDoS and "Call Lawyer" Pressure

Qilin ransomware's extortion model has matured from double-extortion into a fully developed triple-extortion framework. In addition to file encryption and data leakage, Qilin affiliates now routinely deploy DDoS attacks against a victim's remaining infrastructure to sustain operational pressure during negotiations. The Qilin negotiation panel has also been enhanced with a "Call Lawyer" feature that connects victims directly with legal consultants positioned to push for rapid settlement, exploiting regulatory disclosure pressure and legal liability concerns as additional coercion levers. These developments mark a deliberate shift toward professionalized, multi-vector extortion rather than pure ransomware deployment.

#4 — RAMP Forum Seizure and Affiliate Migration

Affiliate operations have been disrupted by significant law-enforcement actions affecting the broader Russian-speaking ransomware ecosystem. The RAMP underground forum, historically Qilin's primary recruitment and coordination platform, was seized by the FBI in January 2026, with affiliate activity migrating to ReHub and other successor platforms. While these actions have introduced friction, Qilin ransomware's affiliate inflow has continued largely uninterrupted, with new affiliates onboarding through successor forums and private referral channels.

#5 — WSL Evasion, Zero-Day Exploitation, and Credential Harvesting

Qilin ransomware operators have refined their evasion tradecraft with increasing adoption of Windows Subsystem for Linux (WSL) to execute components from a Linux runtime context on Windows hosts, a technique that deliberately evades endpoint detection tools lacking WSL visibility. Initial access has also expanded to include exploitation of zero-day and known vulnerabilities in public-facing applications, notably the pre-disclosure exploitation of CVE-2025-31324 in SAP NetWeaver Visual Composer, alongside CVE-2024-21762 and CVE-2024-55591 in Fortinet FortiOS and CVE-2023-27532 in Veeam Backup & Replication Cloud Connect. Qilin affiliates have also expanded credential-harvesting capabilities, particularly Chrome credential-extraction routines that target browser-stored credentials for SaaS platforms, Outlook Web Access (OWA), and Microsoft 365, enabling rapid pivot from on-premises compromise to cloud and email environments.

#6 — Embedded PsExec and Streamlined Lateral Movement

Lateral movement in Qilin ransomware attacks has been streamlined through the embedded deployment of a signed Sysinternals PsExec binary contained directly within the Qilin encryptor itself. Once initial reconnaissance via PowerShell Active Directory enumeration (Get-ADComputer, Test-Connection) identifies domain-joined hosts, the embedded PsExec binary is dropped to disk and used to push the Qilin ransomware payload to every reachable system using harvested credentials. This embedded deployment model reduces dependence on external tool transfer, shortens the dwell-to-encryption window, and complicates detection that relies on identifying standalone admin-tool downloads.

#7 — Outlook: Qilin as a Top-Tier Threat Through 2026

Given Qilin ransomware's sustained dominance, professionalized affiliate management, triple-extortion model, and continued tradecraft evolution, organizations should treat Qilin as a top-tier threat through 2026. Defensive priorities should now include extending EDR coverage to WSL environments, monitoring for embedded PsExec execution patterns originating from non-administrative source processes, deploying behavioral detection over signature-based controls given Qilin's heavy use of signed binaries and living-off-the-land techniques, segmenting Active Directory and VMware ESXi management networks, and reviewing incident response playbooks to account for DDoS pressure and legal-channel coercion during active Qilin ransomware negotiations.

---

Section 03

Recommendations

---

Section 04

Indicators of Compromise (IoCs)

---

Section 05

Potential MITRE ATT&CK TTPs

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

---

Section 06

References & Patch Links

• CVE-2024-55591 — Fortinet PSIRT advisory FG-IR-24-535
• CVE-2024-21762 — Fortinet PSIRT advisory FG-IR-24-015
• CVE-2023-27532 — Veeam knowledge base KB4424
• CVE-2025-31324 — SAP Security Notes, May 2025
• Qilin Ransomware Targets Clinica Maitenes in Chile
• Malware.news coverage: Qilin ransomware targets Clinica Maitenes in Chile
• @_venarix_ analysis of Qilin ransomware activity
• Hive Pro: Qilin Ransomware Surge — A Growing Global Threat to Critical Sectors
• Hive Pro: Agenda Ransomware Group Escalates Attacks With New Multi-Stage Loaders
• Rapid7: Post-RAMP Allegations, Fragmentation, and Ransomware Underground Rebuild
• Hive Pro: The Gentlemen Ransomware — A Rapidly Scaling RaaS Threat