QILIN (AKA AGENDA) — RaaS / Double-Extortion

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Ransomware / RaaS (Double-Extortion) — Origin: INFERENCE: Russian-speaking underground ecosystem (confidence: medium-high)

Author: iQBlack CTI Team

Executive Summary

Qilin (also widely reported under its earlier name “Agenda”) is a ransomware-as-a-service (RaaS) operation active since mid-2022 and repeatedly described in public reporting as a high-throughput affiliate platform combining data theft with encryption (“double extortion”). The group operates an extortion ecosystem that includes victim negotiation, leak-site publication pressure, and a mature affiliate program where the core operators reportedly take a percentage of ransom proceeds (commonly cited as ~15–20%).

From a defender’s perspective, Qilin’s distinguishing risk is not a single “novel” exploit chain but an increasingly professionalized operating model: affiliates leverage common entry vectors (phishing, exposed remote services, credential abuse) and then rely on fast lateral movement, tool-assisted deployment (including remote monitoring/management tools), and recovery inhibition prior to encryption. Public reporting highlights cross-platform capability (Windows + Linux/ESXi) and repeated use of legitimate administrative tooling to reduce friction and blend into enterprise operations.

Operational sophistication appears uneven across incidents (typical of RaaS). Some campaigns show advanced tradecraft (backup targeting, defense evasion techniques such as BYOVD, proxying, and multi-tool orchestration), while others resemble “opportunistic big-game hunting.” This variability is a key analytic point: Qilin should be modeled as an ecosystem with a shared payload/platform but heterogeneous affiliate behaviors.