Qilin ransomware

Qilin is an affiliate-run ransomware programme that encrypts Windows, Linux and VMware ESXi systems and steals data before encrypting. Each intrusion gets its own random file extension, so there is no fixed suffix to look for; instead, the note filename carries that same random value, written as README-RECOVER- followed by the extension and .txt. The note opens with -- Qilin, claims sensitive data was copied, and sends the victim to a Tor chat portal using login credentials printed in the note. Affiliates typically get in through stolen or brokered VPN and RDP logins, phishing emails and internet-facing remote access, then spread with PowerShell, PsExec and remote-management tools and push the encryptor to vCenter and ESXi hosts. Copied files are posted to a Tor leak site when talks fail. Qilin is the renamed continuation of Agenda, which first appeared in 2022 and named its notes with an ID followed by -RECOVER-README.txt; later builds moved from Go to Rust.

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Confirmed — Incident-response analysis documents data theft before encryption, and the note itself states that sensitive data was downloaded and will be published on the Qilin leak site.

Systems typically targeted: Windows and Linux servers, VMware ESXi and vCenter hosts

Do this first: Isolate ESXi and vCenter management networks at once and capture the README-RECOVER note and its matching extension before anyone restores or reimages hosts.