Qilin Ransomware Analysis: Global Surge and Tradecraft Summary

Qilin ransomware has emerged as a top-tier threat, claiming 1,358 victims between April 2025 and March 2026, marking a 443% increase in volume. Operated by the Russian-speaking group Water Galura, the operation follows a Ransomware-as-a-Service (RaaS) model. Notable recent activity includes the 2024 Synnovis attack that paralyzed London pathology services and the 2025 targeting of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Most alarmingly, the North Korean state actor Moonstone Sleet was observed deploying Qilin in 2025, creating significant legal and sanctions risks for any organization considering ransom payments.

Technically, Qilin has evolved from Golang to Rust-based variants, extending its reach across Windows, Linux, and virtualization platforms like VMware ESXi and Nutanix AHV. Intrusions frequently begin with valid credentials purchased on dark web channels roughly one week to three months prior to use. Attackers prioritize defense evasion using 'Bring Your Own Vulnerable Driver' (BYOVD) techniques to disable over 300 different security drivers. There is currently no free decryptor available, and the Qilin.B variant utilizes a sophisticated encryption scheme (AES-256-CTR and RSA-4096) that makes recovery without the attacker's key mathematically impossible.

This threat is high-priority for manufacturing, healthcare, and financial sectors. The lack of active law enforcement indictments or infrastructure seizures suggests Qilin will maintain its high operating tempo. Defenders must shift focus from recovery to exposure reduction, specifically targeting browser credential storage and unpatched edge devices.