Understanding the Qilin Ransomware Threat

In 2025, the Qilin ransomware group has become a major cybersecurity menace, consistently revealing details about over 40 victims each month through their public platform. They hit industries like manufacturing, scientific services, and wholesale trade hard, putting them at the forefront of disruptive ransomware operations globally.

Known previously as “Agenda,” Qilin emerged in July 2022 employing a double-extortion model, coupling file encryption with threats of public data exposure. According to the Talos threat team, they keep a steady attack rhythm, with manufacturing accounting for 23% of attacks, professional services at 18%, and wholesale trade at 10%. The U.S. reports the highest victim numbers, followed by Canada and several European countries. Qilin’s ongoing attack volumes, with over 100 publicized incidents during the summer of 2025, highlight a relentless risk for targeted sectors.

The Strategy of Native Windows Tool Exploitation

Qilin’s uniqueness lies in their use of Microsoft’s Paint and Notepad apps for skimming through sensitive files—a rare tactic allowing them to dodge conventional security safeguards. Logs indicate the opening of documents with these tools, supplemented by data exfiltration using Cyberduck, camouflaged as regular network activity. Attackers, possibly based in Eastern Europe, employ methods to mislead investigations, such as apparent character encoding traces.

Qilin’s approach aligns with human-operated ransomware tactics, yet stands out by exploiting unchecked VPN access without multi-factor authentication and launching attacks via compromised credentials. They conduct thorough reconnaissance using native Windows tools to harvest user information and escalate permissions, deploying encryptors network-wide while employing evasion tactics like bypassing Endpoint Detection and Response (EDR) systems.

Managing Exfiltration and Countermeasures

For exfiltration, Qilin uses compressed data uploads via Backblaze facilitated by Cyberduck, maintaining constant oversight for high-impact negotiations post-ransomware deployment. Personalized ransom notes further pressure victims, supplemented by persistence schemes like scheduled tasks.

As Qilin’s intricate methods demonstrate, including affiliate collaboration and innovative Windows tool usage, rapid adaptation by organizations is crucial. Regular asset inventories, privilege control, and vigilant monitoring can counteract these sophisticated threats, marking Qilin as a formidable challenge in 2025’s threat landscape.

**Fight data threats with Qsentinel. Stay secure. Stay vigilant.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.