RaqibCTI ⌘K
Qilin (fka Agenda) · Ransomware · RaqibCTI
Knowledge / Actors / Qilin (fka Agenda) Corpus Ransomware
Qilin Agenda Water Galura (assessed)
Attribution
RaaS (Russian-speaking, unattributed to a state)
Origin
Unknown (Russian-speaking operators assessed)
Motivation
Financially motivated (ransomware)
Attribution confidence
medium
MENA targeting
UAE, Egypt, Saudi Arabia
Sectors
Logistics, energy, IT services, healthcare
Corpus activity · 6mo 2 mentions
Aug 2026: 1 Sep 2026: 1 A M J J A S
Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Why it matters Ransomware actor, medium confidence, documented targeting UAE, Egypt, Saudi Arabia (Logistics, energy, IT services sectors).
What's next No pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Observed techniques 51 distinct Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.
Technique Name Tactic Observed use T1071.002 ↗ inferred Application Layer Protocol: File Transfer Protocols Command and Control MITRE-attributed to Qilin (S1242) T1219.002 ↗ inferred Remote Access Tools: Remote Desktop Software Command and Control MITRE-attributed to Qilin (S1242) T1003.001 ↗ inferred OS Credential Dumping: LSASS Memory Credential Access MITRE-attributed to Qilin (S1242) T1480 ↗ inferred Execution Guardrails Defense Evasion MITRE-attributed to Qilin (S1242) T1480.002 ↗ inferred Execution Guardrails: Mutual Exclusion Defense Evasion MITRE-attributed to Qilin (S1242) T1484.001 ↗ inferred Domain or Tenant Policy Modification: Group Policy Modification Defense Evasion MITRE-attributed to Qilin (S1242)
Technique overlap
← Cl0p actor Technique overlap ← Lynx actor Technique overlap ← APT33 actor Technique overlap → WIRTE actor Technique overlap ← Nova actor Technique overlap ← 8Base actor Technique overlap ← Monti actor Technique overlap ← Gunra actor Technique overlap T1685.005 ↗ inferred Disable or Modify Tools: Clear Windows Event Logs Defense Evasion MITRE-attributed to Qilin (S1242)
T1685 ↗ inferred Disable or Modify Tools Defense Evasion MITRE-attributed to Qilin (S1242)
T1070.004 ↗ inferred Indicator Removal: File Deletion Defense Evasion MITRE-attributed to Qilin (S1242)
T1112 ↗ inferred Modify Registry Defense Evasion MITRE-attributed to Qilin (S1242)
T1134 ↗ inferred Access Token Manipulation Defense Evasion MITRE-attributed to Qilin (S1242)
T1055.001 ↗ inferred Process Injection: Dynamic-link Library Injection Defense Evasion MITRE-attributed to Qilin (S1242)
T1036.005 ↗ inferred Masquerading: Match Legitimate Name or Location Defense Evasion MITRE-attributed to Qilin (S1242)
T1027.013 ↗ inferred Obfuscated Files or Information: Encrypted/Encoded File Defense Evasion MITRE-attributed to Qilin (S1242)
T1036.004 ↗ inferred Masquerading: Masquerade Task or Service Defense Evasion MITRE-attributed to Qilin (S1242)
T1688 ↗ inferred Safe Mode Boot Defense Evasion MITRE-attributed to Qilin (S1242)
T1222 ↗ inferred File and Directory Permissions Modification Defense Evasion MITRE-attributed to Qilin (S1242)
T1680 ↗ inferred Local Storage Discovery Discovery MITRE-attributed to Qilin (S1242)
T1087.002 ↗ inferred Account Discovery: Domain Account Discovery MITRE-attributed to Qilin (S1242)
T1007 ↗ inferred System Service Discovery Discovery MITRE-attributed to Qilin (S1242)
T1016 ↗ inferred System Network Configuration Discovery Discovery MITRE-attributed to Qilin (S1242)
T1082 ↗ inferred System Information Discovery Discovery MITRE-attributed to Qilin (S1242)
T1083 ↗ inferred File and Directory Discovery Discovery MITRE-attributed to Qilin (S1242)
T1087.001 ↗ inferred Account Discovery: Local Account Discovery MITRE-attributed to Qilin (S1242)
T1135 ↗ inferred Network Share Discovery Discovery MITRE-attributed to Qilin (S1242)
T1673 ↗ inferred Virtual Machine Discovery Discovery MITRE-attributed to Qilin (S1242)
T1018 ↗ inferred Remote System Discovery Discovery MITRE-attributed to Qilin (S1242)
T1012 ↗ inferred Query Registry Discovery MITRE-attributed to Qilin (S1242)
T1057 ↗ inferred Process Discovery Discovery MITRE-attributed to Qilin (S1242)
T1069.002 ↗ inferred Permission Groups Discovery: Domain Groups Discovery MITRE-attributed to Qilin (S1242)
T1047 ↗ inferred Windows Management Instrumentation Execution MITRE-attributed to Qilin (S1242)
T1204.002 ↗ inferred User Execution: Malicious File Execution MITRE-attributed to Qilin (S1242)
T1059.003 ↗ inferred Command and Scripting Interpreter: Windows Command Shell Execution MITRE-attributed to Qilin (S1242)
T1059.001 ↗ inferred Command and Scripting Interpreter: PowerShell Execution MITRE-attributed to Qilin (S1242)
T1204.001 ↗ inferred User Execution: Malicious Link Execution MITRE-attributed to Qilin (S1242)
T1106 ↗ inferred Native API Execution MITRE-attributed to Qilin (S1242)
T1053.005 ↗ inferred Scheduled Task/Job: Scheduled Task Execution MITRE-attributed to Qilin (S1242)
T1489 ↗ inferred Service Stop Impact MITRE-attributed to Qilin (S1242)
T1486 ↗ inferred Data Encrypted for Impact Impact MITRE-attributed to Qilin (S1242)
T1490 ↗ inferred Inhibit System Recovery Impact MITRE-attributed to Qilin (S1242)
T1491.001 ↗ inferred Defacement: Internal Defacement Impact MITRE-attributed to Qilin (S1242)
T1529 ↗ inferred System Shutdown/Reboot Impact MITRE-attributed to Qilin (S1242)
T1566.002 ↗ inferred Phishing: Spearphishing Link Initial Access MITRE-attributed to Qilin (S1242)
T1190 ↗ inferred Exploit Public-Facing Application Initial Access MITRE-attributed to Qilin (S1242)
T1566.001 ↗ inferred Phishing: Spearphishing Attachment Initial Access MITRE-attributed to Qilin (S1242)
T1021.004 ↗ inferred Remote Services: SSH Lateral Movement MITRE-attributed to Qilin (S1242)
T1570 ↗ inferred Lateral Tool Transfer Lateral Movement MITRE-attributed to Qilin (S1242)
T1021.002 ↗ inferred Remote Services: SMB/Windows Admin Shares Lateral Movement MITRE-attributed to Qilin (S1242)
T1547.004 ↗ inferred Boot or Logon Autostart Execution: Winlogon Helper DLL Persistence MITRE-attributed to Qilin (S1242)
T1547.001 ↗ inferred Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Persistence MITRE-attributed to Qilin (S1242)
T1548.002 ↗ inferred Abuse Elevation Control Mechanism: Bypass User Account Control Privilege Escalation MITRE-attributed to Qilin (S1242)
Regional co-occurrence · associated techniques Honesty note Regional co-occurrence is association, not prediction. These techniques appeared alongside Qilin (fka Agenda)'s activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.
Defensive coverage · Microsoft 365 Which Microsoft 365 controls protect , detect , or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.
protect · 16 techniques
Advanced Anti-Phishing T1566 partial Advanced Anti-Phishing T1566.001 partial Advanced Anti-Phishing T1566.002 partial App GovernanceT1548 significant Anti-SpoofingT1566 significant Anti-SpoofingT1566.002 significant Defender for Cloud AppsT1219 significant Multifactor AuthenticationT1566 partial Multifactor AuthenticationT1566.001 partial Multifactor AuthenticationT1566.002 partial Role Based Access ControlT1059 minimal Role Based Access ControlT1087 minimal Role Based Access ControlT1480.002 partial Role Based Access ControlT1484 partial AntimalwareT1027 significant AntimalwareT1036 significant AntimalwareT1059 significant AntimalwareT1059.001 significant AntimalwareT1204 significant AntimalwareT1204.002 significant AntimalwareT1566 significant AntimalwareT1566.001 significant Anti-PhishingT1027.013 partial Anti-PhishingT1566 significant Anti-PhishingT1566.001 significant Anti-PhishingT1566.002 significant AntiSpamT1566 significant AntiSpamT1566.001 significant AntiSpamT1566.002 significant Audit SolutionsT1566.002 partial Information ProtectionT1070 significant
detect · 27 techniques
Adaptive Application Control IntegrationT1036 partial Adaptive Application Control IntegrationT1036.005 partial Adaptive Application Control IntegrationT1204 partial Adaptive Application Control IntegrationT1204.002 partial Advanced Anti-Phishing T1566 partial Advanced Anti-Phishing T1566.001 significant Advanced Anti-Phishing T1566.002 significant App GovernanceT1087 significant App GovernanceT1566 significant Advanced Threat HuntingT1087 significant Advanced Threat HuntingT1566 significant Advanced Threat HuntingT1566.002 significant Defender for Cloud AppsT1071
respond · 10 techniques
Advanced Anti-Phishing T1566 partial Advanced Anti-Phishing T1566.001 partial Advanced Anti-Phishing T1566.002 partial Automated Investigation and ResponseT1204.001 significant Automated Investigation and ResponseT1204.002 significant Automated Investigation and ResponseT1566 significant Automated Investigation and ResponseT1566.001 significant Automated Investigation and ResponseT1566.002 significant Incident ResponseT1059 minimal Incident ResponseT1566 minimal Quarantine PoliciesT1027 significant Quarantine PoliciesT1036 significant Quarantine PoliciesT1204
Countermeasures · D3FEND Defensive techniques that counter Qilin (fka Agenda)'s TTPs, from MITRE D3FEND . The ATT&CK↔D3FEND link is mitigation-mediated — treat these as candidate countermeasures, not prescriptions.
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
Malware Qilin co-mentioned in 2 items Country United States co-mentioned in 2 items Country Japan co-mentioned in 1 item Malware AiLock co-mentioned in 1 item Malware Responder co-mentioned in 1 item Malware impacket-partial-mic co-mentioned in 1 item Country Taiwan co-mentioned in 1 item Malware RansomEXX co-mentioned in 1 item CVE CVE-2020-1472 co-mentioned in 1 item Sector transportation and warehousing co-mentioned in 1 item Malware RustHound co-mentioned in 1 item Malware NetRunner co-mentioned in 1 item minimal
Defender for Cloud AppsT1219 partial
Defender for Cloud AppsT1484 minimal
Defender for Cloud AppsT1484.001 minimal
Defender for Cloud AppsT1486 partial
Microsoft Defender for IdentityT1003 minimal
Microsoft Defender for IdentityT1021 minimal
Microsoft Defender for IdentityT1021.002 minimal
Microsoft Defender for IdentityT1047 minimal
Microsoft Defender for IdentityT1059 minimal
Microsoft Defender for IdentityT1059.001 minimal
Microsoft Defender for IdentityT1069 minimal
Microsoft Defender for IdentityT1069.002 significant
Microsoft Defender for IdentityT1071 minimal
Microsoft Defender for IdentityT1087 minimal
Microsoft Defender for IdentityT1087.002 significant
Preset Security PoliciesT1204 significant
Preset Security PoliciesT1204.001 significant
Preset Security PoliciesT1566 significant
Preset Security PoliciesT1566.001 significant
Preset Security PoliciesT1566.002 significant
Safe AttachmentsT1204 significant
Safe AttachmentsT1204.002 significant
Safe AttachmentsT1566 significant
Safe AttachmentsT1566.001 significant
Security AlertsT1003 significant
Security AlertsT1018 significant
Security AlertsT1069 significant
Security AlertsT1069.002 significant
Security AlertsT1087 significant
Security AlertsT1087.002 significant
Security AlertsT1134 significant
Security AlertsT1484 significant
Security AlertsT1484.001 significant
ATT&CK Simulation TrainingT1204 partial
ATT&CK Simulation TrainingT1204.001 partial
ATT&CK Simulation TrainingT1204.002 partial
ATT&CK Simulation TrainingT1566 partial
ATT&CK Simulation TrainingT1566.001 partial
ATT&CK Simulation TrainingT1566.002 partial
Safe LinksT1204 significant
Safe LinksT1204.001 significant
Safe LinksT1566 significant
Safe LinksT1566.002 significant
Secure ScoreT1021 minimal
Secure ScoreT1204 minimal
Secure ScoreT1204.001 minimal
Secure ScoreT1204.002 minimal
Secure ScoreT1548 minimal
Secure ScoreT1566 minimal
Secure ScoreT1566.001 minimal
Secure ScoreT1566.002 minimal
Threat ExplorerT1566 partial
Threat ExplorerT1566.001 partial
Threat ExplorerT1566.002 partial
Threat TrackerT1566 minimal
Threat TrackerT1566.001 partial
Threat Protection Status ReportT1566 partial
Threat Protection Status ReportT1566.001 partial
Threat Protection Status ReportT1566.002 partial
Identity Secure ScoreT1134 minimal
Audit SolutionsT1059 partial
Audit SolutionsT1070 partial
Audit SolutionsT1087 partial
Audit SolutionsT1548 partial
Audit SolutionsT1566 partial
Information ProtectionT1087 significant
Privileged Access ManagementT1059 partial
significant
Quarantine PoliciesT1204.001 significant
Quarantine PoliciesT1204.002 significant
Quarantine PoliciesT1566 significant
Quarantine PoliciesT1566.001 significant
Quarantine PoliciesT1566.002 significant
Safe AttachmentsT1204 significant
Safe AttachmentsT1204.002 significant
Safe AttachmentsT1566 significant
Safe AttachmentsT1566.001 significant
ATT&CK Simulation TrainingT1204 partial
ATT&CK Simulation TrainingT1204.001 partial
ATT&CK Simulation TrainingT1204.002 partial
ATT&CK Simulation TrainingT1566 partial
ATT&CK Simulation TrainingT1566.001 partial
ATT&CK Simulation TrainingT1566.002 partial
Zero Hour Auto PurgeT1027 significant
Zero Hour Auto PurgeT1036 significant
Zero Hour Auto PurgeT1059 significant
Zero Hour Auto PurgeT1059.001 significant
Zero Hour Auto PurgeT1204 significant
Zero Hour Auto PurgeT1204.001 significant
Zero Hour Auto PurgeT1204.002 significant
Zero Hour Auto PurgeT1566 significant
Zero Hour Auto PurgeT1566.001 significant
Zero Hour Auto PurgeT1566.002 significant
T1566.001
T1204.002
T1204.002
T1566.001
T1036.005
Sector
Manufacturing
co-mentioned in 1 item
Sector health care/social assistance co-mentioned in 1 item
Sector finance and insurance co-mentioned in 1 item
Sector professional, scientific, and technical services co-mentioned in 1 item
Sector services co-mentioned in 1 item
Malware The Gentlemen co-mentioned in 1 item
Sector retail trade co-mentioned in 1 item
CVE CVE-2025-24799 co-mentioned in 1 item
Malware Stormous co-mentioned in 1 item
Sector Construction co-mentioned in 1 item
Sector wholesale trade co-mentioned in 1 item
Sector educational services co-mentioned in 1 item
Malware LockBit 5.0 co-mentioned in 1 item
Country Philippines co-mentioned in 1 item
CVE CVE-2025-2479 co-mentioned in 1 item
Malware SafePay co-mentioned in 1 item
Sector information and communications co-mentioned in 1 item
Malware NightSpire co-mentioned in 1 item