Qilin (aka Agenda) is a RaaS group that has targeted organizations globally since August 2022 using spear-phishing, double extortion, and a portable Go/Rust ransomware that encrypts files with AES-256 or ChaCha20 and appends RSA-encrypted key material to each file. The ransomware disables recovery (shadow copies, event logs, backup/DB services), uses argument-controlled behavior (including a required password check), and drops README-RECOVER-.txt ransom notes threatening data publication. #Qilin #Agenda
Keypoints
- Qilin (Agenda) emerged August 2022 and targets diverse countries and sectors, including education, healthcare, and critical infrastructure.
- Initial access is primarily via spear-phishing and the group operates as Ransomware-as-a-Service with double extortion (data theft + encryption).
- The ransomware requires a “–password” argument which is SHA-256 checked against a hardcoded hash, but enforcement can be bypassed since code is already decrypted.
- It disables recovery by deleting volume shadow copies (vssadmin), clearing event logs via PowerShell, and stopping/disabling backup, DB, virtualization, and security services.
- Qilin terminates processes and services, excludes many OS/backup/security files from encryption, and supports multiple runtime arguments to modify behavior (spread, safe mode, no-network, etc.).
- Files are encrypted with AES-256 by default (or ChaCha20 if no AES-NI); the symmetric key is encrypted with an RSA-4096 public key and appended to the file, preventing local decryption.
- The ransomware is written in Go and Rust, creates execution logs in a QLOG temp folder, changes desktop wallpaper, and leaves README-RECOVER-.txt ransom notes demanding DLS access credentials.
MITRE Techniques
- [T1566] Phishing – Initial access mainly via spear-phishing. Quote: ‘The initial access method is mainly known to be spear phishing.’
- [T1059.001] Command and Scripting Interpreter: PowerShell – Deletes all event logs using a PowerShell script to clear logs: ‘powershell” $logs = Get-WinEvent -ListLog * … [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)’.
- [T1486] Data Encrypted for Impact – Encrypts files with AES-256 or ChaCha20, appends separator and RSA-encrypted AES key to end of file: ‘“—–END CIPHERTEXT BLOCK—-“ is appended … The AES symmetric key encrypted with the RSA public key is then inserted.’
- [T1490] Inhibit System Recovery – Deletes volume shadow copies and disables VSS using vssadmin and service start/stop/change commands: ‘wmic service where name=’vss’ call ChangeStartMode Manual … vssadmin.exe delete shadows /all /quiet … wmic service where name=’vss’ call ChangeStartMode Disabled.’
- [T1489] Data Destruction – Clears event logs leaving only deletion records: ‘a PowerShell script is executed to delete all event logs registered in the system without backup.’
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Maintains persistence via registry entries with randomized 6-character names (prefixed by ‘*’), enabling execution even in safe mode.
- [T1489/ T1499] Service Stop – Stops and disables backup, database, virtualization, and security services (examples: sql, vss, veeamtransportsvc, backupexecjobengine, sapservice): ‘It terminates services … and changes the startup type to disabled.’
- [T1105] Ingress Tool Transfer (lateral tools) – Supports spreading via PsExec when run with the ‘–spread’ argument to propagate across the network.
- [T1562.001] Impair Defenses: Disable or Modify Tools – Targets and terminates security/backup processes (examples: avagent, sophos, veeam) to disrupt defensive measures: ‘continuously checks the processes during file encryption and terminates the processes.’
Indicators of Compromise
- [File Hash ] sample malicious binary MD5 hashes observed – 08a2405cd32f044a69737e77454ee2da, 0d68a310f4265821900249bec89364c2
- [File Hash ] additional MD5 samples – 0d70b3825647082d779987f2772bd219, 119856ec134acc86ef76044cbf291f54 (and 1 more hash)
- [File Name ] ransom note filename pattern – README-RECOVER-.txt (example: README-RECOVER-9_bJ6s6BxF.txt)
- [Registry ] persistence indicator – Run key entries with randomized 6-character value names possibly prefixed with ‘*’ in registry (executes even in safe mode)
- [Commands ] recovery-inhibiting commands – vssadmin.exe delete shadows /all /quiet; PowerShell command to clear event logs (quotes provided in article)
Read more: https://asec.ahnlab.com/en/90497/