MITRE ATT&CKsoftware (malware)

S1242 Qilin

Published 2025-09-26 Modified 2026-04-23 Official page ↗
Domain
enterprise
Platforms
ESXi, Windows, Linux
Aliases
Agenda
Version
2.0
Created
2025-09-26

Description

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.

Related

Uses · MITRE ATT&CK (52)

  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1688 Safe Mode Boot technique
  • T1680 Local Storage Discovery technique
  • T1678 Delay Execution technique
  • T1673 Virtual Machine Discovery technique
  • T1219.002 Remote Desktop Software sub-technique
  • T1480.002 Mutual Exclusion sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1491.001 Internal Defacement sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1021.004 SSH sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.004 Winlogon Helper DLL sub-technique
Show all 52 ›

Referenced by MITRE ATT&CK · uses (2)

  • G1050 Water Galura group
  • G1036 Moonstone Sleet group

References