Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQilin, also called Agenda, is a ransomware-as-a-service (RaaS) operation first observed in 2022. Its affiliates can steal files, encrypt systems and threaten to publish or sell the stolen data. Because affiliates choose different tools and entry points, there is no single Qilin attack script to memorize.
The practical defense is layered: close exposed services, protect administrator and remote-access accounts, limit lateral movement, maintain offline backups that you regularly restore-test, and rehearse an incident plan. The guidance below separates documented Qilin incidents from measures that reduce ransomware risk generally.
As an Amazon Associate I earn from qualifying purchases.
What is Qilin ransomware?
Qilin is a criminal ransomware-as-a-service operation. The group is also known as Agenda, and the Center for Internet Security (CIS) says it was first observed in 2022. In an RaaS model, a core operation develops or provides ransomware, leak-site infrastructure and other services; affiliates find victims and conduct intrusions. Affiliates therefore do not necessarily use the same phishing messages, exploits or command tools in every case.
Qilin uses double extortion. Attackers seek to take copies of valuable data before encrypting systems. They then demand money for a decryption key and threaten to release or sell the stolen information. A company can consequently face an outage, a restoration problem, privacy obligations and reputational pressure at the same time. Encryption is only one part of the risk.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What the available figures do—and do not—show
| Figure | Scope and qualification |
|---|---|
| 29 incidents | Qilin ransomware incidents reported to the Multi-State Information Sharing and Analysis Center (MS-ISAC) by U.S. state, local, tribal and territorial (SLTT) organizations from December 2023 through June 30, 2025, according to CIS. This is not a worldwide total. |
| 55% | Share of those 29 reports that CIS says occurred in the second quarter of 2025. |
| 24% versus 9% | Qilin’s share of U.S. SLTT ransomware incidents reported to MS-ISAC in Q2 2025 versus Q1 2025, respectively. The comparison applies only to that reporting population. |
| Up to $500,000 | The highest ransom demand CIS reported in its Q2 2025 SLTT profile. One described victim refused a $500,000 demand; it is not an average or standard price. |
See the CIS Q2 2025 profile for the incident set and its definitions.
How does Qilin ransomware work?
There is no authoritative, universal sequence for every affiliate. The following model combines the behaviors reported by CIS and two separate Sophos investigations; it is a way to understand defensive priorities, not a promise that every attack follows each stage.
- Initial access: An affiliate obtains a foothold through phishing, a vulnerable public-facing application, an exposed remote service or stolen credentials.
- Privilege and persistence: The intruder seeks more capable accounts, creates or alters accounts, changes policy or installs tools that make the access durable.
- Discovery: Systems, users, shares, backups and security controls are mapped to identify the most valuable and disruptive targets.
- Lateral movement: The attacker moves from the first device to servers, identity infrastructure, remote-management systems or connected customer environments.
- Data theft: Files are collected and compressed for later extortion. The tools and destinations vary by affiliate.
- Backup and recovery disruption: Shadow copies, backup systems or administrative controls may be disabled or deleted, making restoration harder.
- Encryption and extortion: Ransomware encrypts reachable systems, displays a demand and may leave a deadline or leak threat.
- Covering tracks: Some documented incidents included log clearing and self-deletion, reducing the evidence available to defenders.
Incident responders should treat every stage as an opportunity to contain the intrusion. Stopping an account takeover before it reaches identity systems is materially easier than recovering after encryption and data theft.
A documented MSP campaign
In a 2025 analysis, Sophos described a Qilin affiliate that sent an administrator of a managed service provider (MSP) a fake ScreenConnect security alert. A lookalike site captured the administrator’s password and a time-based multifactor authentication (MFA) code. The attacker then reached the MSP’s remote-management environment, deployed a separate ScreenConnect instance across managed customers and used it for discovery and credential-related actions.
The affiliate collected customer files with WinRAR, uploaded archives to EasyUpload, targeted backups and deployed Qilin ransomware across multiple customer environments. Sophos says the ransomware stopped and disabled Volume Shadow Copy Service, deleted shadow copies and Windows event logs, enumerated hosts, changed wallpaper and deleted itself after execution. This is one investigated campaign, not evidence that ScreenConnect, WinRAR or those exact actions appear in every Qilin intrusion. Read the Sophos MSP analysis for the incident details.
A separate credential-theft incident
Sophos reported another incident observed in July 2024 in which attackers used compromised credentials to access a VPN portal that had no MFA. After moving to a domain controller, they changed Group Policy to run scripts that harvested credentials saved in Chrome on endpoints. The stolen credential files were exfiltrated and deleted, followed by log clearing and encryption. This case shows why an investigation may need to examine browser-stored credentials and other accounts beyond the first compromised identity; it does not establish browser theft as a universal Qilin technique. The Sophos credential-theft report describes the observed chain.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How does Qilin get into a network?
CIS lists phishing, exploitation of public-facing applications and external remote services such as Remote Desktop Protocol (RDP) among reported initial-access paths. Sophos’s cases add stolen credentials, a VPN without MFA and an MSP’s downstream connections. The right response is to remove several entry opportunities rather than hunt for one “Qilin signature.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Phishing and adversary-in-the-middle pages
A convincing alert can lead an administrator to a counterfeit sign-in page. In the MSP case, the page captured both a password and a time-based MFA code. Ordinary MFA still improves security, but real-time phishing proxies can relay some codes or approval prompts. Train staff to open security portals from known bookmarks, verify unexpected alerts through a separate channel and report suspicious messages quickly. For high-risk administrators, use phishing-resistant authentication such as FIDO2 where your systems support it.
Exposed applications and unpatched appliances
Public-facing applications, firewalls, VPN gateways, remote-management servers and other appliances are reachable from the internet. A missed security update can turn one service into an entry point. Keep an inventory of internet-facing assets, remove systems that are no longer required, restrict management interfaces by network or device, and apply vendor security updates promptly.
Remote services and stolen credentials
RDP, VPNs and remote-management platforms should not be broadly reachable with a password alone. Require MFA, conditional access from managed devices, least-privilege roles and short session lifetimes where practical. Disable dormant accounts, rotate credentials after staff or supplier changes, and monitor impossible-travel, unfamiliar-device and unusual administrative activity. A compromised account can be reused against other services, so changing only the password that first triggered an alert may be insufficient.
Third-party and MSP pathways
An MSP, software supplier or contractor can have powerful access to many customer networks. Review which vendors can administer systems, which accounts they use and whether their access is logged and time-limited. Separate customer environments, require strong authentication for support staff and establish an emergency process to revoke remote-management access. The Sophos MSP case demonstrates the potential blast radius of one service provider compromise; it does not mean every MSP connection is unsafe.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Weak passwords and unnecessary privilege
CIS describes an MS-ISAC-reported SLTT incident in which a phishing link led to a user account with a weak password and unnecessary administrative access. Attackers created new administrator accounts and encrypted data across the network. Make ordinary user accounts non-administrative, use unique passwords stored in an approved password manager, and alert on new privileged accounts and privilege changes.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How can I protect my business from ransomware?
Protection is a program of mutually reinforcing controls. The NCSC recommends defense in depth: assume one control can fail, then make detection, containment and recovery possible when it does.
1. Patch the systems attackers can reach
- Maintain an accurate inventory of operating systems, applications, firmware, firewalls, VPN products and internet-facing services.
- Install security updates as soon as they are available; enable automatic updates where they are safe and supported.
- Prioritize vulnerabilities affecting exposed services and identity infrastructure.
- Remove unsupported software or isolate it until replacement is possible.
The UK National Cyber Security Centre’s “Mitigating malware and ransomware attacks” guidance (version 3.0) recommends prompt updates as part of a broader ransomware program.
2. Harden identity, email and administration
- Require MFA for email, VPN, remote administration, cloud consoles and MSP access. Prefer phishing-resistant methods for privileged users.
- Use conditional access so sensitive systems accept connections only from managed devices, approved locations or compliant security states.
- Apply least privilege and separate daily accounts from administrator accounts.
- Review service accounts, API keys, shared credentials and browser-saved passwords; rotate or remove anything unnecessary.
- Assess staff with controlled phishing exercises and teach a simple reporting route.
- Configure email authentication and flag messages that fail DMARC checks, while recognizing that a passing check does not prove a message is safe.
3. Limit movement after a foothold
- Segment user devices, servers, backups, identity systems and management networks.
- Restrict RDP and administrative protocols to approved jump hosts or management networks; do not expose them directly to the internet.
- Disable scripting or macro features that are not needed for the business, and monitor unusual use of PowerShell, Group Policy and remote-management tools.
- Centralize endpoint, identity, firewall and cloud logs so an intruder cannot erase every copy from one host.
- Alert on new administrator accounts, mass file changes, shadow-copy deletion, log clearing and unusual archive creation or outbound transfers.
4. Build backups that survive the attack
Backups are useful only when attackers cannot encrypt or delete every copy and the organization can restore them under pressure. The NCSC calls up-to-date backups “the most effective way of recovering from a ransomware attack.” The FBI likewise recommends regular, verified backups kept separate from the systems they protect.
| Backup characteristic | More resilient approach | Weak approach to avoid |
|---|---|---|
| Isolation | Offline, disconnected or otherwise protected copies; removable devices disconnected after backup. | An external drive or backup share permanently connected with the same administrator credentials as production. |
| Copies and locations | Multiple copies across separate media, services or physical locations. | One device or one cloud account that can be deleted from the compromised production console. |
| Immutability and versions | Protected cloud versions, retention locks or write-once media where appropriate, with separate deletion credentials. | Backups that can be overwritten or purged by an ordinary administrator. |
| Recovery confidence | Scheduled restoration drills, documented dependencies and known-clean recovery devices. | Backups never restored or validated since they were created. |
| Coverage | Endpoints, servers, identity configuration, SaaS data, critical applications and network documentation. | Only user documents, with no plan for identity services or application rebuilds. |
Define recovery priorities and recovery-time targets before an incident. Record who can authorize a restore, where clean credentials are kept, which systems must be rebuilt first and how restored machines will be checked for persistence. A physical external hard drive or USB stick can be one offline copy, but it is not a complete backup strategy by itself.
5. Prepare people and decisions
Write an incident plan that names technical leads, executives, legal and privacy contacts, communications staff, insurers and outside responders. Include procedures for isolating devices, suspending remote-management tools, preserving evidence, notifying customers and meeting jurisdiction-specific reporting deadlines. Exercise the plan with a scenario in which production systems are encrypted and sensitive files are known to have been copied. Update contact details and recovery instructions after each exercise.
What should you do if Qilin activity is suspected?
- Contain carefully: Disconnect affected hosts from networks and disable suspected remote-management or VPN access, but avoid wiping or powering off systems before responders advise you if evidence may be needed.
- Protect identity: From a known-clean device, disable compromised accounts, revoke sessions and tokens, rotate privileged credentials and review newly created accounts. Assume credentials stored on an affected endpoint may be exposed.
- Preserve evidence: Secure relevant logs, ransom notes, email headers, firewall records, cloud audit trails and a timeline of observed changes. Keep a copy in storage the intruder cannot alter.
- Stop further spread: Isolate backup systems and management networks, block suspicious outbound destinations and suspend automated jobs that could propagate encryption.
- Engage qualified responders: Incident-response specialists can scope persistence, identify exfiltrated data, support negotiation decisions and guide clean restoration. Verify credentials and regional availability before signing a service agreement.
- Assess obligations: Determine whether personal, regulated or contractual data was accessed and obtain legal advice on notifications. Do not assume a ransom note is a complete account of what was stolen.
- Report: In the United States, the FBI asks victims to contact a local field office or report through the Internet Crime Complaint Center (IC3). In the United Kingdom, use the NCSC incident-reporting route and consider reporting to Report Fraud. Other jurisdictions have different agencies and deadlines.
- Restore methodically: Rebuild from known-clean media, patch before reconnecting, reset credentials, verify monitoring and restore the highest-priority services first. Test restored data with business owners.
Should you pay a ransomware ransom?
The FBI does not support paying a ransom and warns that payment does not guarantee the return of data. Its guidance states: Paying a ransom doesn’t guarantee you or your organization will get any data back.
The FBI ransomware guidance also directs victims toward reporting and assistance.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
The NCSC warns that payment cannot guarantee access, leaves the computer infected until it is rebuilt, funds criminal groups and may make an organization a more attractive future target. Refusing payment is not a guarantee of recovery either: stolen data may still be disclosed and backups may still fail. Make the decision with incident responders, legal counsel, insurers and law enforcement, checking sanctions and other legal restrictions before any transaction is considered.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can Qilin ransomware files be decrypted?
The available sources do not establish a current, guaranteed Qilin-specific decryptor. The NCSC says files encrypted by most ransomware typically cannot be decrypted by anyone other than the attacker. Some cases may be helped by weaknesses in a particular ransomware build, an available key or a tool published by the No More Ransom Project, but availability changes and success is never assured.
Do not install an unverified “decryptor” on affected systems or assume a consumer security utility will recover files. Preserve encrypted copies, identify the exact ransomware note and file extension, consult qualified responders, and check reputable official resources such as the NCSC ransomware guidance. Recovery planning should rely on clean, tested backups rather than a promised decryption tool.
What the evidence means for a small organization
Small businesses often share identities, remote tools and backup administration across a limited team, so one stolen administrator credential can have disproportionate consequences. Start with controls that reduce the largest single points of failure:
- List every internet-facing service and close or restrict anything unnecessary.
- Turn on MFA for email, VPN and administrator accounts; move privileged users to phishing-resistant authentication where feasible.
- Separate administrator accounts from daily accounts and remove unnecessary rights.
- Keep at least one disconnected backup, plus another copy in a separate location or protected service.
- Perform a real restore test and write down the rebuild order.
- Agree in advance who isolates systems, who contacts customers and who reports the incident.
These measures address the access, spread and recovery problems documented in Qilin cases without assuming that every affiliate uses the same software or sequence.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
