Qilin Ransomware Adds Automated Enterprise Spread and VMware Targeting

Qilin, also known as Agenda, has evolved from a manually operated Rust ransomware binary into a modular payload capable of automated enterprise-wide propagation, according to Seqrite’s comparison of March and October 2026 samples. The newer variant adds Active Directory reconnaissance, embedded PsExec-based deployment, VMware vCenter and ESXi targeting, and multi-session token handling. These capabilities expand its reach across Windows environments and virtualization infrastructure. Qilin operates as a double-extortion ransomware-as-a-service operation, with reported attacks affecting healthcare, manufacturing, education, and technology organizations.

The ransomware selects AES-256-CTR or ChaCha20 based on processor capabilities, uses intermittent file encryption, and protects session keys with an embedded RSA-4096 public key. It also uses Windows Restart Manager to release locked files, forces Safe Mode reboots to evade some endpoint security sensors, prints ransom demands through network printers, and deletes execution artifacts. The expanded capabilities underscore the need to restrict remote administrative execution, isolate virtualization management systems, and maintain recovery options that remain accessible if production endpoints and hypervisors are compromised.