Qilin: affiliate operations, identity theft and downstream access

Assessment at a glance

Identity: Qilin ransomware-as-a-service, previously Agenda. Model: a service and affiliate ecosystem, not one uniform intrusion team. Naming: no numbered APT or universal CrowdStrike/Microsoft alias is assigned here. Sophos's STAC4365 designation identifies the affiliate activity discussed below; it is not a replacement name for the entire Qilin operation.

Evidence currency: this profile rests on two Sophos investigations. The first covers activity observed in July 2024 (published 22 August 2024). The second covers an incident from late January 2025 (published 1 April 2025). Against this profile's date of 30 October 2026, the newest incident is about 21 months old and its publication about 19 months old. The evidence describes tradecraft observed in 2024 to early 2025, not Qilin's current tradecraft, and it should not be read as a statement about the group's operations since.

Sophos dates the programme to 2022. Its investigations illustrate why attribution should distinguish the ransomware brand, the affiliate controlling an intrusion and any supplier of initial access. The same encryptor can conclude materially different intrusion chains. Sophos ScreenConnect investigation

Programme background

Sophos reports that Qilin recruits affiliates on Russian-language cybercrime forums. It uses a Tor-hosted data-leak site to pressure victims. In May 2024, actors associated with Qilin launched a clearnet leak site named "WikiLeaksV2", hosted at an address provided by a Russian internet service provider that Sophos says has been tied to command-and-control, malware hosting and phishing activity in the past. Sophos reports the site remained active and was linked in the ransom notes in the 2025 incident.

Sophos also notes that Qilin was in the news in June 2024 because of its attack on Synnovis, a service provider to UK healthcare organisations. Related TIR coverage of that event appears below.

Affiliate composition and attribution limits

Sophos relays a Microsoft Threat Intelligence report that Qilin's affiliates have grown to include a North Korean state actor Microsoft labels "Moonstone Sleet". This is second-hand: it is Microsoft's claim as cited by Sophos, and the supplied sources do not include Microsoft's own reporting or independent corroboration. We do not assess whether that actor was involved in either incident discussed here. The claim matters mainly as a reminder that the Qilin name can cover affiliates with very different motivations and capabilities, which weakens any assumption that a ransomware brand maps to one operator.

Two intrusion paths

July 2024: Chrome credential harvesting

In a July 2024 incident examined by Sophos, compromised credentials enabled VPN access; Sophos found the VPN portal lacked multifactor authentication. The investigation described an 18-day gap between initial access and further movement. Sophos states this interval "may or may not indicate" that an Initial Access Broker made the actual incursion, so the evidence does not settle whether one operator or a handoff between operators is involved. Sophos credential-theft investigation

After lateral movement to a domain controller with compromised credentials, the attacker edited the default domain policy to add a logon-based Group Policy Object containing two items:

• A PowerShell script, IPScanner.ps1, placed in a temporary directory on the SYSVOL share, which attempted to harvest credentials stored in Chrome.
• A batch script, logon.bat, which launched the first script.

Because this was a logon GPO, the scripts ran on each client as users logged in. On each endpoint the script created a SQLite database file (LD) and a text file (temp.log), written back to a directory on SYSVOL named for the host. The attacker left the GPO active for over three days. After the harvested files were stolen and exfiltrated, the attacker deleted them and cleared event logs on the domain controller and affected machines, then encrypted files and dropped the ransom note. Ransomware execution also used GPO, through a scheduled task that ran a batch file named run.bat to download and execute the ransomware.

Sophos notes that other domain controllers in the same domain were encrypted, but the controller where the GPO was configured was not. Sophos does not explain this and treats it as outside its investigation; it could reflect a misfire, an oversight or testing, and we draw no conclusion. The Chrome harvesting was seen on a subset of endpoints. That establishes credential theft in this incident, not a claim that every Qilin deployment behaves identically. Sophos detects the ransomware as Troj/Qilin-B and the script as Troj/Ransom-HDV.

January 2025: MSP ScreenConnect compromise

In late January 2025, an MSP administrator received phishing impersonating a ScreenConnect authentication alert. Sophos describes an adversary-in-the-middle flow, built with the open-source evilginx framework, that captured credentials and an emailed one-time password and let the attacker authenticate to the legitimate ScreenConnect Cloud portal with the administrator's super-administrator account. Sophos attributes the incident with high confidence to its STAC4365 affiliate cluster, citing similar infrastructure, domain naming patterns, techniques and tools to phishing campaigns it traced back to late 2022. Sophos ScreenConnect investigation

Sophos reports the phishing sites used lookalike ScreenConnect domains and JavaScript redirects keyed to a tracking link, so that visitors arriving directly, such as researchers, were sent to the legitimate portal. The attacker then used the administrator's access to push an attacker-managed ScreenConnect instance, via a file named ru.msi, to multiple managed customers. Reported follow-on activity across customer environments included:

• Network and user discovery, and resetting of user account credentials.
• Use of PsExec, NetExec and WinRM for credential access and remote execution.
• A file named veeam.exe that exploits CVE-2023-27532 in Veeam backup software, allowing an unauthenticated user to request unencrypted credentials from the local configuration database. Sophos says its name, path and SHA256 hash match a file Huntress reported in a 2023 ScreenConnect-related attack that did not lead to ransomware.
• Data collection with WinRAR, and exfiltration of the archives to easyupload.io through a Chrome Incognito session. The attackers removed tools after use.
• Identification and targeting of backups at multiple customers, and modification of boot options so devices would restart in Safe Mode with networking.

Sophos's analysis of the ransomware binary reported functions including stopping and disabling Volume Shadow Copy Service, deleting shadow copies, enabling symbolic links, enumerating hosts, deleting Windows event logs, setting a ransom wallpaper and self-deletion. Each customer had its own unique 32-character execution password and its own chat ID in the ransom note, which Sophos takes to indicate the actor knew it was targeting distinct organisations.

The MSP case documents abuse of authorised remote-management access following phishing. It does not establish compromise of ScreenConnect's software build or update distribution. Calling it a software update implant would obscure the control failure defenders need to address.

Credential reach and operational leverage

TIR assessment: browser credential theft changes the recovery boundary. Removing ransomware does not revoke collected passwords or determine whether they were reused in cloud services, supplier portals or privileged administration. Sophos notes defenders cannot compel users to change passwords on third-party sites, so the practical response is to establish which users and systems were exposed, then prioritise rotation and session revocation by privilege and reach.

TIR assessment: an MSP super-administrator account can turn one authentication failure into several customer incidents because the management plane already has trusted access. Inventory that reach explicitly: which tenants, endpoints, scripts and backup systems can each identity control? Customer separation and stronger authentication are separate protections; neither follows automatically from using a familiar support product.

Dwell time and uncertainty

The 18-day gap belongs to one incident. It is not Qilin's average dwell time and does not prove active operator control throughout the interval; Sophos itself leaves open that a broker may have obtained the access. Initial access, any transfer between operators and later ransomware deployment should be recorded separately where evidence permits.

Evidence of affiliate continuity does not demonstrate continuity across all Qilin victims. Useful case comparisons need identity paths, infrastructure, tools and timing, with confidence attached. Shared commercial or open-source tools, such as evilginx, ScreenConnect or WinRAR, are weak attribution evidence on their own.

Detection and recovery

TIR recommendations: monitor privileged Group Policy changes and unexpected scripts delivered through logon mechanisms, including new files in SYSVOL. Correlate VPN authentication with domain administration and endpoint activity. Investigate unusual remote-management administrator logins, authentication changes, new users and broad script execution across customers. Watch for installation of an unfamiliar second remote-management instance and for unexpected Safe Mode boot configuration changes. Retain management-platform audit trails outside the account under investigation.

Revoke compromised sessions as well as changing passwords. Review backup and recovery permissions separately from ordinary endpoint administration, and patch Veeam against CVE-2023-27532. Establish whether an administrator's browser held credentials for other environments; avoid restoring those credentials into a clean workstation without rotation. Test customer separation by examining effective permissions, not merely nominal tenant labels.

Preventive controls

Sophos's reporting supports the following controls, which address the failures seen in these two cases:

• Multifactor authentication on VPN access. Its absence was the enabling failure in the July 2024 case, and Sophos says MFA would have been an effective preventative measure there.
• Phishing-resistant authentication such as FIDO2 for administrative and third-party services. In the January 2025 case, the attacker relayed an emailed one-time code, which phishing-resistant methods are designed to resist.
• Conditional access limiting corporate applications and third-party services to known managed devices.
• DMARC enforcement, with email controls that flag or block messages failing the check, and phishing training that covers lookalike domains.
• Safe Mode protection. Sophos recommends protection against Safe Mode restarts without endpoint protection. Sophos customers can enable active attack enhancements in Sophos Central through Endpoint and Server Threat Protection policies; other organisations should seek equivalent controls.
• Avoiding browser-stored passwords. Sophos advises using vetted, independently tested password managers rather than browser-based storage.

Related coverage and update record

Related TIR reporting includes the Lee Enterprises disruption and the London hospital disruption. These are contextual reading, not independent proof of the technical chains above.

Version 1 — 30 October 2026: initial profile based on Sophos reporting from 2024 and 2025; separates Qilin from STAC4365 and identity-mediated downstream compromise from compromised software updates.