INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Qilin ransomware attacks ESXi servers via affiliate networks globally

| 2026-10-28 05:19 CRITICAL MEDIUM RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
In 2022, the Russian-speaking ransomware-as-a-service operation Qilin began its activities and by 2025 had become one of the most prolific groups with over 1,000 claimed victims. The group employs a flexible platform allowing affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, typically gaining initial access through phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. Qilin follows a double-extortion model, encrypting systems while threatening to publish stolen data via their blog and WikiLeaksV2 platform. Notably, the 2024 Synnovis attack affected UK healthcare services, and notable incidents also include attacks on US healthcare services, Canadian healthcare services, Irish healthcare services, and other targets in these countries.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 19 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 19 IoCs Create Free Account
sha1 3 sha256 12 domains 1 md5 3
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered SpiderThe GentlemenThe GentlemenMoonstone SleetMoonstone Sleet QilinQilin
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎2026/10/28
Threat actors using Qilin ransomware-as-a-service operation exploited vulnerabilities in ESXi systems to target victims, often gaining initial access through phishing or stolen credentials.
victims 1,000 claimed victims
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims.
threat_actor Moonstone Sleet
Qilin has been linked to Moonstone Sleet and Scattered Spider, with some operators creating derivative operations including The Gentlemen and Securotrop, the latter maintaining affiliate status while operating an independent leak site.
threat_actor Scattered Spider
Qilin has been linked to Moonstone Sleet and Scattered Spider, with some operators creating derivative operations including The Gentlemen and Securotrop, the latter maintaining affiliate status while operating an independent leak site.
threat_actor The Gentlemen
Qilin has been linked to Moonstone Sleet and Scattered Spider, with some operators creating derivative operations including The Gentlemen and Securotrop, the latter maintaining affiliate status while operating an independent leak site.
organisation Affiliates
Affiliates typically gain initial access through phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools.
Tactical Metrics
Metrics
victims
1,000
Claimed Victims
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims.
Intelligence Sources
AlienVault OTX 2026-10-28