If Qilin ransomware is suspected, activate your incident-response plan immediately, isolate affected systems in a coordinated way, preserve volatile evidence, determine whether the intrusion includes data theft, notify the right authorities and stakeholders, and restore critical services only from clean, tested backups. Do not assume that every Qilin technique or leak claim applies to your incident: Qilin operates through affiliates whose methods vary, and a ransom note does not prove what information was accessed or taken.
What should we do first after a Qilin ransomware attack?
The first objective is to stop further damage without destroying evidence. CISA’s #StopRansomware Guide is general ransomware guidance rather than a Qilin-specific playbook, but its sequence is appropriate: follow the organization’s approved incident-response plan, identify impacted systems, isolate them, preserve evidence, and coordinate reporting and recovery.
As an Amazon Associate I earn from qualifying purchases.
- Declare the incident and activate the incident-response plan. Bring together security, IT, executive leadership, legal and privacy counsel, communications, business-continuity staff, cyber-insurance contacts and relevant service providers. Assign one incident commander and keep an incident timeline. CISA’s guide states: “Should your organization be a victim of ransomware, follow your approved IRP.”
- Move coordination to a trusted channel. Use phone calls or another out-of-band method for sensitive decisions when feasible. An intruder may still monitor corporate email, collaboration systems or administrative tools and may react when defenders begin containment.
- Identify affected assets and isolate them quickly. Disconnect compromised endpoints and servers from wired and wireless networks, remove them from VPN access, and disable known compromised accounts or remote sessions through the approved response process. If multiple systems or subnets are involved, responders may need to take network segments offline at the switch level.
- Preserve cloud evidence. When appropriate, retain cloud-volume snapshots and relevant audit records before routine retention processes overwrite them.
- Protect the evidence before making destructive changes. Record who performed each action and when. Avoid wiping, reimaging or rebooting systems until responders decide what evidence must be captured.
- Start reporting and legal review early. Notify CISA, the local FBI field office or FBI Internet Crime Complaint Center (IC3) as appropriate. If personal, regulated or otherwise sensitive information may be involved, begin the organization’s breach-notification analysis for every relevant jurisdiction.
Containment should be coordinated rather than improvised. Isolating one visible workstation while leaving an attacker’s access to identity infrastructure, backup systems or remote services can allow the encryption phase to continue.
Recommended Free Tools
Should we shut down affected computers?
Shutting down a device can stop active processes and prevent additional encryption, but it can also destroy volatile evidence, especially system memory and temporary execution data. Treat power-off as a constrained decision, not an automatic first step.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Prefer logical or network isolation when responders can disconnect the system, disable its network port, block routing, or otherwise contain it while keeping it powered for evidence collection.
- Consider powering down when a device cannot be disconnected by other means and leaving it running presents an immediate risk of continued spread or destructive activity.
- Document the decision. Note the system, time, person authorizing the action, observed behavior and any evidence collected first.
Do not reconnect an isolated machine merely to check whether it appears normal. A dormant intruder, scheduled task or stolen credential may remain even when the ransom screen is no longer visible.
How do we preserve evidence while containing the attack?
Evidence can show how the attacker entered, which accounts and systems were used, whether data was copied, and whether access remains. Preserve it in a way that supports both technical investigation and possible legal proceedings.
Capture volatile and system evidence
- Make forensic images of relevant disks where feasible.
- Capture system memory before shutdown when trained personnel and approved tools are available.
- Preserve Windows Security logs, firewall log buffers and other logs that may be overwritten quickly.
- Retain samples of precursor malware, scripts, ransom notes and indicators of compromise.
- Preserve cloud-volume snapshots and cloud audit records when they may help reconstruct activity.
Look beyond encrypted machines
Review endpoint, network and other detection systems for earlier-stage compromise and additional affected devices. Examine identity and remote-access activity, administrative actions, backup infrastructure and systems that appear unaffected but share credentials or network paths with encrypted hosts. A ransomware event may be the final stage of an intrusion that began days or weeks earlier; encryption is not proof that the attacker’s work was limited to the files displaying a ransom note.
Maintain an evidence log
For every collection or containment action, record the asset identifier, time in UTC, collector, method, storage location and any hash or chain-of-custody information required by the organization. Restrict access to collected material and preserve originals while analysts work from copies.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
How can we tell whether Qilin stole our data?
Assess three questions separately: which systems were encrypted, whether information was exfiltrated, and whether the adversary still has access. The answers can differ. A server may be encrypted without evidence of theft, while an unencrypted file server may have been searched or copied.
Test the exfiltration hypothesis
- Review firewall, proxy, endpoint and cloud logs for unusual outbound transfers, especially before encryption began.
- Compare network-volume changes with normal baselines and look for transfers to unfamiliar external destinations or newly used storage services.
- Search for staging archives, compression utilities, unusual file-access patterns and accounts accessing large numbers of sensitive files.
- Check identity, remote-service and administrator logs for the accounts and hosts associated with those actions.
- Classify potentially exposed information—such as personal, health, financial, intellectual-property or operational data—so legal and privacy teams can assess notification duties.
Qilin is associated with double extortion: affiliates may encrypt systems and threaten to publish or otherwise exploit stolen data. The Center for Internet Security (CIS) describes attacks as having a high likelihood of data theft, but that is a threat profile, not proof about a particular victim. Affiliates’ tactics vary, and a threat actor’s statement about the volume or type of data should be treated as an unverified claim until evidence supports it.
Preserve the ransom note, negotiation messages, leak-site references and any list of allegedly stolen files. Do not download or redistribute stolen material simply to verify a claim; involve legal counsel, law enforcement and qualified forensic specialists.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat is Qilin ransomware, and how common is it?
CIS identifies Qilin, also known as Agenda, as a double-extortion ransomware-as-a-service operation first observed in 2022. Because affiliates conduct attacks under the operation’s umbrella, the initial access route, tools and post-compromise behavior can differ between incidents. Reported routes include phishing, exploitation of public-facing applications and external remote services, but none of those routes can be assumed for a specific organization without investigation.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Measure | CIS finding | How to interpret it |
|---|---|---|
| Share of U.S. SLTT ransomware incidents attributed to Qilin in Q2 2025 | 24% | CIS compared this with 9% in Q1 2025; the figure covers incidents reported to MS-ISAC, not global ransomware activity. |
| Qilin incidents reported by U.S. SLTT entities from December 2023 through June 30, 2025 | 29 | A count within CIS/MS-ISAC’s stated reporting population and period. |
| Share of those 29 reports received in Q2 2025 | 55% | A historical distribution of the reports, not a forecast. |
| Ransom demand in one CIS-observed incident | $500,000 | The victim refused; this is an incident example, not a typical Qilin demand. |
| Exfiltration claims in other Qilin incidents | Up to 500 GB | Claims reported by the actor or incident sources; they are not independently established amounts for every case. |
CIS’s September 11, 2025 article said: “In Quarter 2 (Q2) of 2025, Qilin became the most active ransomware targeting U.S. State, Local, Tribal, and Territorial (SLTT) government entities, with nearly a quarter of all incidents attributed to its operation.” These statistics are historical and limited to U.S. SLTT reporting; they should not be presented as current 2026 prevalence or as a global rate.
Who should be notified?
Use the incident plan’s escalation tree, but include the groups that can make decisions and meet obligations:
- Executive leadership and the incident commander: approve priorities, emergency spending and risk acceptance.
- Security and IT: contain hosts, preserve evidence, eradicate access and plan restoration.
- Legal and privacy: assess contracts, regulatory duties, privilege, sanctions concerns and notification requirements.
- Communications: coordinate employee, customer, supplier and public statements through authorized spokespeople.
- Business continuity: identify essential services, manual workarounds and dependency order.
- Cyber-insurance and specialist providers: follow policy notice requirements and approved-retainer procedures.
Report to CISA, the local FBI field office or FBI IC3 as appropriate, and share useful indicators with CISA or a sector information-sharing and analysis center when permitted. CISA’s guidance recommends consulting federal law enforcement about possible decryptors even while mitigation is underway. Legal deadlines differ by organization, sector and jurisdiction; obtain current jurisdiction-specific advice rather than relying on a generic timetable.
Should we pay the ransom?
The FBI says it does not support paying ransom and recommends contacting a local FBI field office or filing a report at IC3. Payment does not guarantee decryption, deletion of stolen data, confidentiality or an end to the intrusion. It can also create sanctions, accounting, insurance, contractual and regulatory issues.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Leadership should make any decision only after legal counsel, law enforcement, the insurer and qualified incident-response advisers assess the facts. That assessment should include whether backups can restore operations, what data may have been taken, whether the actor still has access, and whether a proposed payment would violate applicable restrictions. Do not let a countdown timer or leak threat replace evidence-based analysis.
How do we restore systems safely?
Recovery should follow business impact and technical dependencies, not simply the order in which ransom screens appeared. A hospital, payment system, identity service or production line may depend on shared authentication, databases, DNS, network services or specialized applications. Define the minimum viable service for each critical function and restore prerequisites first.
- Establish a clean recovery environment. Use a recovery network or VLAN whose systems have been assessed and cleaned. Permit only verified clean devices and tightly control administrator access.
- Validate backup sources. Prefer offline, encrypted backups. Check that backup sets are available, complete and internally consistent, and verify that they predate the compromise when possible.
- Test before broad deployment. Restore representative systems in isolation, confirm applications and dependencies work, and scan for persistence or unauthorized accounts before connecting them to production.
- Restore in dependency order. Bring back core identity, network and management services only after they are trusted, then restore critical applications and data, followed by lower-priority systems.
- Harden and monitor each restored service. Reset credentials, remove compromised accounts and remote tools, apply available security updates, enable appropriate logging and watch for renewed suspicious activity.
- Reconnect gradually. Add systems in controlled waves, verifying that restored hosts communicate only with approved services and that no encrypted or unassessed machine can reintroduce the attacker.
- Document the recovery. Record what was restored, from which backup, by whom, when and with what validation result.
CISA recommends maintaining offline, encrypted backups and regularly testing both their availability and integrity. An encrypted external hard drive can be one physical component of an offline backup workflow, but a single drive is not a resilient organizational backup design: recovery also requires multiple protected copies, access controls, tested procedures and coverage for critical dependencies.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What should happen after operations return?
Do not close the incident when files are decrypted or systems are online. Complete a post-incident review that identifies the initial access path, compromised credentials, persistence mechanisms, systems touched, data-access findings, containment delays and backup gaps. Preserve relevant evidence according to legal and retention requirements, share appropriate indicators with CISA or a sector ISAC, and update the incident-response plan with specific owners and deadlines.
- Verify that privileged and service-account credentials were rotated and that multifactor authentication and remote-access controls reflect the lessons learned.
- Confirm that public-facing applications and external remote services are inventoried, patched and monitored.
- Test restoration exercises, including loss of identity services, backup infrastructure and key personnel.
- Review segmentation so that a compromised workstation cannot reach backup repositories or unrelated critical systems.
- Rehearse trusted communications and an out-of-band contact list.
The practical standard is simple: contain first, investigate beyond the encryption, report through the right channels, and restore only what can be trusted. Qilin’s double-extortion model makes data-theft analysis as important as decryption, while affiliate variation means the organization’s own evidence must determine what happened.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
