Search — “Qilin”

A weekly recap reports that the Qilin (aka Agenda) RaaS operation has claimed more than 900 victims so far in 2026, citing Acronis. Acronis says affiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools, and that Qilin can encrypt local files, network shares and VM infrastructure. The sources give no specific technical indicators or detection guidance for this activity, so hunters should rely on general ransomware precursors such as remote-management tool abuse.

Group-IB and NyxLab attribute a large campaign to the actor k0t, who reportedly scans for exposed Fortinet FortiGate and Palo Alto GlobalProtect devices, exploits CVE-2025-64446 and CVE-2026-0257 or brute-forces credentials, and establishes an OpenConnect VPN foothold. Sources describe persistence via MeshCentral, Atera, Teramind, AnyDesk-like tools and AdaptixC2, Rclone exfiltration to Wasabi and MEGA, and AD enumeration with Impacket and Mimikatz. Hunters should look for OpenConnect sessions from edge devices, unexpected RMM agents, and Rclone or AdaptixC2 activity; the sources say more than 70,000 credentials were identified, and the actor is assessed as a possible access broker for Qilin and The Gentlemen.

Rapid7's Q3 2026 threat analysis reports that high-severity vulnerabilities were exploited within an average of three days of disclosure, with 71% exploited in the first seven days, and 79% classed as remote with no credentials or local user involvement. The report covers ransomware leaders (The Gentlemen, Qilin, INC Ransom, DeadLock, Krybit), nation-state groups, dark web access broker activity, and AI use in only 8% of tracked incidents. No specific CVEs, malware hashes, or detection queries are printed in the source, so hunting value is limited to reviewing patch timelines and monitoring for unexpected AI API usage.

Unit 42 reports that ransomware operators, including Qilin (Spikey Scorpius), Inc (Tarnished Scorpius) and Settra-linked actors, are exploiting the KEV-listed GlobalProtect portal/gateway authentication bypass CVE-2026-0257. They bypass MFA to establish VPN sessions, run reconnaissance with RMM tools, move laterally over RDP/SMB, and pivot to vCenter/ESXi. On ESXi they disable execInstalledOnly and dump credentials offline from a domain controller VMDK. Some actors chain the access with the Veeam exploit CVE-2023-27532. Hunters should check GlobalProtect logs for gateway-connected events from the listed IPs, the fake host IDs/MACs and the PoC client values. They should also look for VPN-to-vCenter access and ESXi security-setting changes.