Qilin Ransomware in 2026: Tradecraft, RaaS Evolution, and Risk for Chile

Qilin Is Not Just Ransomware That Encrypts at the End

Analyzing Qilin only as a ransomware family leads us to focus on the most visible phase of the incident and, in many cases, the least useful one for prevention. In 2026, the appropriate unit of analysis is broader: a Ransomware-as-a-Service operation with a core team, heterogeneous affiliates, multiple access paths, legitimate and malicious tooling, capabilities across Windows, Linux, and VMware ESXi, double extortion, and a significant evolution in defense evasion.

Its public lineage begins in 2022 under the name Agenda. Over time, Qilin became the predominant name for both the operation and the associated ransomware. MITRE ATT&CK currently tracks Qilin as S1242, keeps Agenda as related software, and separately identifies Water Galura / GOLD FEATHER (G1050) as the group operating the RaaS service. This separation is not merely taxonomic: it allows us to distinguish the encryption code, the criminal infrastructure, the operator team, and the affiliates that actually conduct the intrusions.

The central judgment of this research is high confidence: Qilin should be considered one of the most operationally relevant ransomware threats in 2026, not because of a single technique or an exceptional encryptor, but because of the combination of scale, affiliate diversity, exploitation of remote access, credential abuse, progression through Active Directory, degradation of defenses, exfiltration, attacks against backups and virtualization, and multiplatform impact capabilities—the full ecosystem. Trend Micro documents sustained expansion throughout 2024-2025; Check Point kept it among the operations with the highest observable volume during 2026; and Cisco Talos added a particularly relevant element by analyzing an EDR killer used in Qilin attacks with the ability to interfere with more than 300 security-product drivers.

The ransomware event does not begin when the ransom note appears on some random employee’s desktop. For Qilin, the decisive phase usually starts much earlier: remote access or credentials → identity and privileges → Active Directory → lateral movement → defense degradation → exfiltration → backups/virtualization → encryption and impact.

This distinction also changes the conversation for a CISO or management. The question is no longer whether the organization can detect a Qilin binary or accumulate millions of IoCs, but whether its identity, remote access, Tier-0, telemetry, backup, and virtualization controls can interrupt an adversarial chain before the actor reaches a position from which ransomware deployment is almost an operational formality.

For Chile, the conclusion is equally important. There is sufficient public evidence to state with high confidence that Qilin is already part of the real threat landscape for Chilean organizations. However, the lack of public transparency does not allow every organization listed on a Data Leak Site to be automatically treated as a confirmed victim. We also have to consider the LACK of transparency from companies that conceal from users the actual compromises involving their data. Here, two positions often collide: the perspective of those protecting the company, where “the business is the priority” and nothing that could damage reputation will be disclosed, and the ethical perspective in which the organization takes a mature stance, understands how to manage incidents when they occur, and communicates with transparency and a clear remediation plan.

1. Before Talking About Victims: How to Read the Evidence

A ransomware investigation quickly degrades when it mixes three different things: what the criminal actor claims, what a third party reports, and what can actually be supported by primary or forensic evidence. With Qilin, this distinction is especially important because a significant portion of public visibility comes from Data Leak Sites and trackers that replicate those listings.

DLS data is useful for measuring observable extortion pressure, relative activity, timing, and potential sector patterns. It is not a reliable census of intrusions. A publication may be genuine, exaggerated, duplicated, incomplete, or even false; a compromised organization may pay before it is published; an affiliate may migrate between RaaS programs; and different vendors apply different deduplication, collection, and dating rules. Therefore, adding together numbers from Trend Micro, Check Point, ReliaQuest, SOCRadar, Ransomfeed, or other trackers as if they represented confirmed incidents would create apparent precision, not robust intelligence. (Although those of us who work in CTI know that most Chilean claims from recent years correspond to real incidents—not all of them.)

A claim confirms that the actor or a tracker published an allegation. By itself, it does not confirm access, exfiltration, encryption, data volume, or actual impact—but that does not mean it is false either. That distinction matters.

The taxonomy used in this research preserves that separation and, more importantly, preserves the confidence level when information is translated into defensive or executive decisions.

Confidence is not binary either. An attribution may be strong regarding the existence of the incident and weak regarding the actor; a tracker may have high confidence that it observed a listing and low confidence that the breach occurred as described. That granularity is fundamental in the Chilean context, where official incidents, aggregated attributions, and multiple named claims exist, but they do not always converge in a single primary source.

This is not an academic precaution. Poor classification changes risk. If a CISO interprets a claim as a confirmed intrusion, they may overreact to weak evidence; if they dismiss every claim because it is not confirmed, they may ignore an early signal of relevant activity. Useful CTI does not eliminate uncertainty: it makes uncertainty visible, traceable, and actionable.

2. Qilin, Agenda, RaaS, Operators, and Affiliates: Separating the Brand from the Intruder

The Agenda → Qilin continuity carries high technical confidence, although different sources do not identify exactly the same point in time for the naming transition. Trend Micro places the first observed Agenda operations in July 2022, initially using ransomware written in Go, and documents Rust variants toward the end of that same year. Group-IB places the formal promotion of the RaaS model on underground forums in early 2023. MITRE currently uses Qilin as the primary entry and Agenda as related software.

From that point onward, it is useful to abandon the idea of a single ‘Qilin group’ executing a homogeneous sequence. A RaaS model decouples the ransomware brand from the actor who gains access and conducts the intrusion. The practical consequence is that two incidents can both end with Qilin and still present different initial access methods, tooling, persistence, exfiltration, and operational timelines.

MITRE attributes payload generation, negotiation, and publication of stolen data for affiliates to Water Galura / GOLD FEATHER, along with affiliate recruitment on Russian-language forums. That attribution is relevant when modeling the operation, but it does not justify automatically attributing every intrusion involving Qilin to Water Galura.

Affiliate heterogeneity is one of the most important elements for detection. Arctic Wolf observed Qilin intrusions in 2026 that shared initial exploitation and Qilin deployment but diverged afterward: some progressed toward double extortion, while others accelerated directly to encryption. The payload may remain relatively stable; the pre-ransomware tradecraft does not.

There are also public relationships that require caution. Microsoft and Trend have associated limited Agenda/Qilin use with Moonstone Sleet in 2025; that association does not demonstrate that the North Korean actor controls Qilin, nor does it turn the RaaS operation into a state-backed structure. Trend has also assessed that some affiliates migrated following the disruption of RansomHub, while Check Point has linked the founder of The Gentlemen to prior experience as a Qilin affiliate. These relationships are useful for understanding the criminal market, but they should not be confused with a single identity behind all cases.

3. Evolution 2022-2026: From Configurable Ransomware to a Cross-Environment Impact Operation

Qilin’s evolution cannot be summarized as a simple improvement to the encryptor. The most significant change has been the expansion of the criminal operating system around the payload: more platforms, more access paths, greater abuse of legitimate tools (LOTL, for those who know ;) ), the ability to attack recovery and virtualization, and defense evasion that by 2026 already includes kernel-level manipulation.

The transition from Go to Rust is relevant for malware analysis, but it would be a mistake to make it the main evolution story. Organizational risk did not increase simply because the code changed languages. It increased because the operational ecosystem enabled affiliates to move from remote access into identity, Active Directory, backups, and VMware, while the ransomware became the final component of a chain capable of simultaneously producing loss of confidentiality, availability, and recovery capability.

The Synnovis case shows why this distinction matters. NHS England confirmed that the June 3, 2024 incident severely reduced laboratory processing capacity, caused more than 11,000 delays or cancellations, and required months for full restoration. Authorities later indicated that the incident contributed to a patient’s death; public attribution to Qilin was reported by Reuters. The ransomware stopped being a problem of encrypted files and became a problem of clinical continuity and human safety.

RISK IMPLICATION

When identity, virtualization, and recovery share the same trust plane, a ransomware incident can stop being an endpoint event and become a simultaneous disruption of multiple services that are critical to operational continuity, with all the associated consequences.

4. The Technical Center of Gravity: The Pre-Ransomware Ecosystem

The most important technical characteristic of Qilin in 2026 is not the encryptor. It is the ability of different affiliates to enter through different paths and converge on the same operational objectives: identity, Active Directory, remote administration, defenses, data, backups, and virtualization.

This observation changes the way threat hunting should be performed. A binary signature can be useful to confirm a late phase. It is not enough to interrupt the attack. The highest-return strategy is to detect and validate behaviors that appear before impact, even when the tool used by the affiliate changes. (If threat hunting in your company is based only on a few queries and IoC lists, I hope this is the beginning of a change.)

4.1 Initial Access: Remote Access and Identity as a Recurring Surface

The research finds support for several initial-access paths. Group-IB documented activity associated with Fortinet/SSL-VPN infrastructure and exploitation of public-facing services; in some cases, there were indications of password guessing or brute force, although log deletion prevented the exact mechanism from being fully confirmed. Sophos investigated an intrusion initiated with compromised credentials against a VPN without MFA, with approximately 18 days of dwell time before ransomware deployment. Trend has historically described Initial Access Brokers, stolen credentials, and, in more recent campaigns, social-engineering techniques.

In 2026, the remote perimeter appears prominently again. Arctic Wolf observed multiple Qilin intrusions initiated through CVE-2026-0257 against GlobalProtect; Unit 42 independently confirmed active exploitation of that vulnerability. Check Point linked another post-exploitation case to Qilin following exploitation of CVE-2026-50751 in Remote Access/Mobile Access.

Chile fits the same risk class. The January 2026 OIV/PSE case, reproduced from a National CSIRT alert, described brute-force access against a WatchGuard firewall where controls such as MFA and adequate lockout mechanisms were absent. The relevant point is not WatchGuard as a product: it is the convergence of exposed remote access, weak authentication, and a subsequent path toward internal assets.

TECHNICAL JUDGMENT - HIGH CONFIDENCE

Remote access + identity is the primary intersection between Qilin’s global tradecraft and the public Chilean evidence. Replacing one VPN vendor with another without fixing MFA, exposure management, lifecycle management, lockout/risk-based authentication, and segmentation does not eliminate the risk class.

4.2 Credential Access: Stealing Credentials Does Not Always Mean Running Mimikatz

Qilin and its affiliates have used multiple methods for credential access. Group-IB observed integrated Mimikatz modules for accessing tokens and privileged processes. Arctic Wolf documented LSASS dumping in 2026 using rundll32/comsvcs.dll and NTDS extraction through ntdsutil IFM. Trend also describes access to credentials stored by Veeam in certain variants or campaigns.

The case documented by Sophos is particularly valuable because it shows a more systemic identity operation. The actor modified Group Policy and used scripts placed in SYSVOL to collect credentials stored in Google Chrome from domain endpoints. The technique turns a legitimate domain-administration capability into a distributed credential-collection mechanism. The problem is no longer just a compromised workstation: it is the conversion of the AD administration plane into an access multiplier.

This forces a review of the Tier-0 concept. If GPO, SYSVOL, administrative accounts, backup credentials, and vCenter share administration paths or reused identities, the declared logical segmentation may not exist operationally.

4.3 Discovery: The Attacker Needs to Understand the System Before Destroying It

Trend documents nltest, whoami, net group, PowerShell/AD enumeration, WMI, process/network discovery, and ESXi enumeration. Arctic Wolf observed SoftPerfect Network Scanner and NetExec in recent intrusions. These are familiar tools and commands to any administrator or pentester, which reduces the value of detection based only on process name.

The opportunity lies in context: who performs the enumeration, from which segment, after which authentication event, against what volume of hosts, and with what temporal relationship to privilege changes or remote access. An nltest executed from an authorized PAW during maintenance is not equivalent to a burst of AD discovery from a workstation newly reached from a VPN session.

It is also important not to inflate the profile with “typical ransomware” commands when no specific observation exists. The research only elevates to Qilin-supported techniques those for which evidence exists in the reviewed sources. That discipline prevents ATT&CK mapping from becoming a generic checklist with little analytical value.

4.4 Lateral Movement and Persistence: Legitimate Tools, Fan-Out, and Remote Administration

Documented lateral movement includes RDP with stolen credentials, SMB/admin shares, and PsExec. Modern Rust variants can incorporate PsExec into the ransomware itself; other campaigns have shown Cobalt Strike, SSH/PuTTY, and RMM tools. Arctic Wolf also identified MeshAgent and a \MeshUserTask task in 2026 incidents, together with AnyDesk, LogMeIn, and Ngrok in different contexts.

The defensive value is not in indiscriminately blocking every dual-use tool. In large organizations, many of them are necessary. The control must distinguish authorized use from anomalous use: a new RMM installation or tenant, execution from hosts outside the baseline, remote-service creation, ADMIN$/C$ fan-out, new east-west sessions from VPN pools or user endpoints, and privileges used outside the expected administrative plane.

Persistence may include Run/RunOnce, modification of service ImagePath values, scheduled tasks, creation of administrative accounts, and GPO changes. Each technique carries a different meaning when it appears after anomalous remote access or alongside credential dumping. Correlation across phases is more robust than an isolated signature.

4.5 Defense Evasion: When Losing EDR Telemetry May Be the Detection

Defense evasion is one of the areas where Qilin shows the clearest technical evolution. Early service/process termination and log-clearing capabilities have been complemented by BYOVD and specialized components. Cisco Talos analyzed msimg32.dll, a multi-stage loader associated with Qilin attacks and likely executed through DLL side-loading. The chain uses techniques to evade hooks and telemetry, interfere with ETW, manipulate kernel objects, and load rwdrv.sys/hlpdrv.sys. Talos indicates that the toolset can neutralize callbacks and terminate processes associated with more than 300 EDR-product drivers.

The most important detail for a SOC is not memorizing the name msimg32.dll. It is recognizing a new property of the incident: the defensive control itself can become an active target. If multiple endpoints stop reporting in a coordinated manner during a sequence of privileged activity, treating the event as a simple agent-health problem may discard precisely the signal the attacker is generating.

HIGH-VALUE DETECTION

A collective loss of EDR heartbeats, accompanied by privileged execution or anomalous driver loading, should be treated as a possible attack signal and correlated with independent telemetry: firewall, NDR, Windows Event Forwarding, SIEM, vCenter, and backup-platform data.

This also limits a defensive strategy centered exclusively on EDR. The research does not suggest that EDR is irrelevant; quite the opposite—it shows that EDR is valuable enough for the adversary to actively neutralize it. But its capability must be complemented by tamper protection, vulnerable-driver controls, and observability sources that survive endpoint degradation.

4.6 Exfiltration: Double Extortion Without a Universal Tool

There is no single exfiltration tool associated with Qilin. Trend has observed MEGAsync and WinSCP; Arctic Wolf has documented Rclone, MEGA, Proton Drive, and FileZilla in different 2026 incidents. The relevant pattern is functional: a legitimate or portable utility, often executed from a high-value server, generating high-volume transfers to cloud or file-sharing services before the encryption event.

This reinforces another analytical separation: ransomware detection should not begin with T1486. Exfiltration may be the point at which the actor already has enough control to create regulatory and reputational impact, even if encryption never occurs. For data-intensive sectors—healthcare, finance, hospitality, services—publication-based extortion may become the primary objective.

4.7 Backups, Veeam, and VMware/ESXi: Attacking the Ability to Recover

Qilin seeks to degrade recovery through deletion of VSS/shadow copies, manipulation or deletion of backups, and targeting of Veeam. Group-IB documented deletion of jobs, tapes, and backups; Trend records damage to VMware snapshots and disks; MITRE explicitly maps Inhibit System Recovery (T1490).

The VMware/ESXi capability is not theoretical. MITRE lists ESXi as a platform, and Trend documents Linux/ESXi variants, propagation through vCenter, password changes, shutdown of virtual machines, and deletion of disks or snapshots.

The architectural implication is severe. Many organizations consolidate dozens or hundreds of services onto a relatively small virtualization and backup control plane. If the same domain, the same privileged accounts, or the same administration paths can reach AD, Veeam, and vCenter, the actor can turn an identity compromise into a concentrated recovery failure. The efficiency that makes virtualization attractive operationally can also amplify the blast radius when the management plane is compromised.

For Chilean sectors with high VMware dependency—industry, healthcare, mining, government, logistics—the defensive question should not simply be whether backups exist. It should include whether backup and hypervisor identities are separated, whether independent administrative access exists, whether snapshots can be destroyed from the same trust plane, and whether full restoration has actually been tested.

4.8 The Encryptor and Cryptography: Important, but Not the Best Defensive Surface

Cryptographic implementations vary across builds. Group-IB analyzed variants using AES-256/CTR or ChaCha20 with RSA-4096 asymmetric protection; Trend documents other builds using AES-256 and RSA-2048. This variation is consistent with configurable generations and reinforces the fragility of a strategy based exclusively on cryptographic details or payload signatures.

From a Threat Engineering perspective, the priority is not to prove which algorithm each sample uses unless the objective is malware research or specific recovery work. For risk reduction, the value comes earlier: preventing the actor from reaching credentials, Tier-0, backup privileges, or the ability to distribute the payload at scale.

5. Qilin Does Not Have a Universal Attack Chain: The Problem of Detecting a RaaS

A direct consequence of the RaaS model is that we should not infer that every Qilin intrusion deploys every component described above. Much of the tooling belongs to the affiliate, not the core service. This explains why one campaign may show Cobalt Strike while another does not; why one intrusion uses Rclone and another MEGA; or why two cases involving the same ransomware differ in persistence, dwell time, and phase ordering.

The defensive mistake would be to build a “universal Qilin signature” from a single sample or forensic case and assume the next affiliate will repeat the sequence. A more resilient strategy combines phase-based detections with temporal and contextual correlation: unusual remote access + privileged discovery + GPO manipulation + telemetry loss + administrative fan-out + backup modification provides far more value than waiting for a hash.

The equivalent analytical mistake would be to attribute all observed activity to the central operator. In a RaaS model, the ransomware may be the common element while tactical decisions—how to enter, which tools to use, how long to remain, what data to steal, and when to encrypt—belong to the affiliate. Therefore, “Qilin” can describe the ecosystem/payload with high confidence in certain cases, but it does not always identify the intrusion set responsible for every step.

6. Global Victimology: Observable Volume, Sector Diversity, and Impact

Public datasets agree that Qilin achieved very high visibility throughout 2025 and 2026, although their figures are not directly comparable. Trend Micro counted 1,377 organizations claimed between October 2022 and January 31, 2026, and almost 1,400 publications during 2025. Check Point recorded 338 publications during Q1 2026 and 279 during Q2, keeping Qilin among the most prolific operations in its dataset.

These figures should be read as DLS telemetry, not as a count of confirmed breaches. Even so, their persistence across independent datasets, together with the growth of tooling and campaigns observed by incident-response teams, supports the conclusion that Qilin remains a top-tier operation in 2026.

Trend identifies manufacturing, healthcare, and technology among the prominent sectors, while its 2025 attack-attempt telemetry places manufacturing especially high, followed by financial services, healthcare, and government. Dragos, from an industrial perspective, describes Qilin as one of the persistent operations targeting industrial organizations and continued to consider its activity relevant during Q1 2026.

Victimology is not limited to large corporations either. The affiliate model and exploitation of repeatable attack surfaces favor organizations of different sizes. The opportunity may lie in a valid credential, a vulnerable appliance, a VPN without MFA, or a trust relationship—not necessarily in the public importance of the brand.

6.1 Synnovis: When Availability, Data, and Physical Safety Intersect

The Synnovis incident is a useful reference for separating “ransomware” from “ransomware impact.” NHS England documented severe disruption to laboratory services, more than 11,000 delays or cancellations, and a prolonged recovery process. Public attribution to Qilin was reported by Reuters, and authorities later indicated that the incident contributed to a patient’s death.

For a CISO, this case changes the unit of impact. The critical asset is not only the encrypted server: it may be the ability to process a test, deliver a result, operate a logistics chain, produce food, manage a port, or sustain a government process. Technical risk materializes when services depend on identity, virtualization, data, and recovery capabilities that the attacker can degrade together.

Ransomware severity should be modeled as loss of business capability, not as the number of encrypted endpoints or a generic severity score.

7. Chile: Demonstrable Presence, Public Named Victimology Still Incomplete

The most important finding for Chile is not a list of names. It is that there are independent public signals—official incidents or incidents close to official sources, aggregated attributions, and named claims—that justify treating Qilin as an operationally relevant local threat.

The strongest evidence identified includes a significant-impact incident reported in January 2026 involving an unidentified strategic OIV/PSE entity (or at least that is what some authorities say). The public reproduction of alert AIC26-00002 linked the incident to Qilin at an early stage and described brute-force access against a WatchGuard firewall without MFA and without adequate lockout mechanisms or restrictions. The entity remains “anonymous.”

There is also public information attributed to ANCI stating that Qilin was behind three of five particularly costly government incidents during 2025. The signal is relevant, but the specific identities and forensic details were not published. Therefore, the correct conclusion is not “these three institutions were confirmed Qilin victims,” but rather “there is sufficiently strong aggregated attribution to elevate Qilin risk in the Chilean public sector.”

In parallel, during 2026 multiple Chilean organizations appeared in trackers reproducing claims from Qilin’s DLS. The research records Valbifrut, Ducasse Comercial, Conectados Chile, Graneles de Chile, NOI Hotels, Comercial Echave Turri, Clínica Maitenes, ATCOM Outsourcing, AGUNSA, and Difor, among others. In these cases, the public evidence demonstrates that a listing attributed to Qilin existed; it does not by itself demonstrate that the organization suffered exactly the access, exfiltration, encryption, or data volume alleged by the actor.

This distinction is particularly important when communicating intelligence. Labeling every listing as a “confirmed victim” artificially increases certainty, contaminates historical datasets, and can produce incorrect sector-level conclusions. By contrast, preserving states such as Claimed, Reported, and Confirmed allows the assessment to be updated as new evidence appears.

The incidents involving the Instituto de Salud Pública and the Subsecretaría de Prevención del Delito illustrate another methodological difficulty. Both were real incidents and temporally coincided with communications about Qilin, but the reviewed sources do not provide sufficiently strong public attribution to turn that coincidence into a fact. The research keeps them as confirmed incidents with unverified Qilin attribution rather than forcing a more attractive but less rigorous narrative.

JUDGMENT ON CHILE

High confidence that Qilin already operates within Chile’s threat landscape. Medium confidence in public named victimology. The absence of public confirmation for every organization does not reduce the need to act on the tradecraft that is already demonstrated.

8. Which Chilean Sectors Should Pay the Most Attention?

Sector risk should not be derived only from which names appear on the DLS. It should be built at the intersection of proven tradecraft, architectural exposure, and business consequence. An organization may never have appeared on a leak site and still share exactly the same conditions Qilin has exploited elsewhere.

For Chile’s productive industry, risk concentration often lies in the dependency between corporate IT and operations: vendor VPNs, Active Directory, file systems, ERP, virtualization platforms, and services that sustain production or logistics. An attacker does not need to compromise a PLC directly to stop a plant if they can encrypt or remove the IT infrastructure coordinating orders, quality, dispatch, or traceability.

In healthcare, the consequence can be even more direct. Disruption of clinical systems, laboratories, identity, or virtualization can translate into reduced care availability. In government, the combination of legacy remote access, multiple vendors, and citizen data increases both the attack surface and the regulatory and reputational cost. In technology/MSP environments, risk is amplified through RMM and multi-tenant tooling: an identity or platform with cross-environment authority can become an access multiplier.

Sector assessment, therefore, is not a prediction of who will be attacked. It is a way to decide where the same technique can produce greater consequences.

9. 2026-2027 Outlook for Chile: What Is Reasonable to Expect and What Is Not

The most reasonable hypothesis is not an operation exclusively focused on Chile. The evidence is more consistent with global affiliates exploiting repeatable surfaces—credentials, remote access, vulnerable appliances, RMM, and Windows/VMware environments—and finding those same conditions in Chilean organizations.

The concentration of claims during 2026 across agribusiness, technology, industry, hospitality, healthcare, and logistics is a signal of sector-diverse activity. It does not demonstrate a single campaign or common affiliate. In a RaaS model, assuming that several temporally close listings belong to the same intrusion set without shared infrastructure, artifacts, or specific TTPs would be excessive attribution.

Remote access will likely remain a priority surface. In roughly one year, public research has associated Qilin with Fortinet/SSL VPN infrastructure, WatchGuard in Chile, Palo Alto GlobalProtect, and Check Point Remote Access/Mobile Access. That vendor diversity is itself a signal: the risk does not lie in a specific brand, but in the class of exposed asset and in the attacker’s ability to turn perimeter access into internal identity.

It is also reasonable to expect that evolution will occur at least as much in affiliate tooling and access as in the encryptor itself. The RaaS ecosystem allows affiliates to rapidly adopt new vulnerabilities, loaders, RMM, and defense-evasion techniques without waiting for a new generation of ransomware. The 2026 evidence around CVE-2026-0257 and the EDR killer reinforces that interpretation.

Disruptions of other RaaS programs can also alter Qilin’s volume through affiliate migration. Trend has assessed movements after RansomHub, and there are public precedents of actors operating as affiliates before forming new brands. Confidence here is medium: affiliate economics are opaque, and criminal identities overlap, change aliases, or exaggerate relationships.

An MSP/RMM scenario should be considered seriously because of its blast-radius potential, but the research did not find sufficient evidence to claim a Qilin supply-chain campaign against Chile. The correct framing is one of risk and hypothesis: Qilin has used legitimate RMM, and organizations with multi-tenant tooling or provider access concentrate authority that warrants JIT/PAM controls, tenant restrictions, and session monitoring. That exposure should not be transformed into an attributed campaign without evidence.

10. Key Intelligence Judgments

The following judgments synthesize the research while keeping their evidentiary foundations explicit. Their purpose is not to produce absolute certainty, but to support decisions proportional to the quality of the evidence.

11. Detection Engineering: Detect the Chain, Do Not Wait for the Ransomware

The highest-return detection opportunities against Qilin occur before T1486 (encryption). The objective is not to recognize a known sample, but to identify when an identity, host, or administration plane begins behaving as part of an adversarial chain.

A robust strategy should combine signals that may be legitimate in isolation: a successful VPN login, nltest, an RDP session, a GPO modification, PsExec, or a cloud transfer. Temporal context and the relationship between identities, segments, and assets turn those signals into an attack hypothesis.

The research prioritizes five detection families in particular: anomalous identity activity in remote access; GPO/SYSVOL changes and credential access on Domain Controllers; PsExec/admin-share fan-out; EDR degradation and driver loading; and destructive activity against backups/vCenter. These should be complemented by exfiltration from high-value servers and anomalous RMM use (CPU, network, cloud resources, etc.).

One particularly important principle is telemetry independence. If the endpoint is an active target, the organization needs sources that survive endpoint compromise: firewalls, NDR, IdP, Windows Event Forwarding, SIEM, vCenter, Veeam, and appliance logs. The detection control cannot depend exclusively on the same sensor the adversary is trying to disable.

Overengineering Qilin-specific signatures should also be avoided. A hash, a path such as C:\PerfLogs\win.exe, or a specific driver may be excellent contextual indicators for an observed campaign. They should not become the only coverage. The affiliate can change the filename or tooling while preserving the same adversarial function.

The useful unit of hunting is the hypothesis. For example: “an identity obtained through remote access is rapidly progressing toward Tier-0”; “an actor is turning GPO/SYSVOL into a distribution mechanism”; “endpoint visibility is being degraded before fan-out”; “a high-value server begins transferring data outside its baseline.” These hypotheses survive changes in malware better than an IoC list.

12. Control Validation: What an Organization Should Test Before the Next Incident

Qilin is also a useful case for separating control deployment from control validation (something I explore in more depth in previous blog posts). Having MFA, EDR, segmentation, and backups does not demonstrate that those controls change the outcome of the observed chain. The mature question is what evidence exists that each control works against the scenario it is intended to reduce.

12.1 For Red Team and Security Validation

Emulation does not require deploying real ransomware to validate the relevant properties. A controlled exercise can test whether an account compromised through VPN can reach administrative segments; whether GPO/SYSVOL has alerting and change control; whether credential dumping on a DC generates a response; whether PsExec or admin-share fan-out is detectable; whether EDR degradation triggers escalation; and whether backup or vCenter identities are truly separated from the ordinary domain.

The valuable output is not “Domain Admin was achieved.” It is identifying which control should have interrupted the chain, whether the control was observed, why it failed, and how the organization will demonstrate that the path remains closed after remediation. With Qilin, this is especially important because the payload can change while the operational objectives—identity, recovery, virtualization—remain.

12.2 For SOC and Blue Team

The SOC should build playbooks that correlate identity, endpoint, and control-plane telemetry. An alert about driver loading should not be evaluated without knowing whether the host lost EDR heartbeat, whether recent privileged login activity occurred, or whether PsExec activity is present. Likewise, a valid VPN login should not be automatically closed as benign if, within minutes, the identity begins domain discovery and accesses administration servers.

The absence of telemetry must carry security meaning. An agent that stops reporting may be an operational problem; twenty agents that stop reporting after privileged activity may represent an attack phase. That distinction requires centralized health telemetry and explicit escalation paths.

12.3 For Infrastructure and IT

The priority is reducing blast radius. Domain Controllers, Veeam, and vCenter should not be administrable from the same segments and identities used by ordinary endpoints. Backup/hypervisor accounts should be separated where feasible; VPN access to RDP/SMB and administrative planes should be limited to justified paths; unsupported appliances should be removed from the perimeter; and restore drills should validate recovery of complete services, not merely the existence of copies.

A backup control that cannot restore under pressure is not a proven recovery capability. Likewise, a hypervisor that depends on the same compromised domain for all administration can turn an operational-efficiency control into a concentration point of risk.

12.4 For Risk, GRC, and Leadership

Qilin should be modeled as a combined business interruption + confidentiality breach + third-party risk + regulatory incident scenario. Reducing it to the category of “malware” hides the interaction between data loss, unavailability, executive crisis, and regulatory obligations.

For organizations subject to Chile’s Law 21.663, detection and escalation are also part of the control. The research notes that incidents with potentially significant impact require an early warning to the National CSIRT within a maximum of three hours from the moment the organization becomes aware of the incident, followed by updates within the regulatory timelines. SOC detection latency, executive escalation, and regulatory reporting form a single operational chain.

The business metric must go beyond “percentage of successful backups.” There must be an understanding of Maximum Tolerable Downtime and Recovery Time for services dependent on AD, virtualization, and backup. The Synnovis impact shows why an organization needs to translate infrastructure loss into service loss.

13. Priority Risk Scenarios for Chile

A useful way to operationalize the research is to convert tradecraft into scenarios. These scenarios do not predict a specific incident; they allow organizations to review whether current architecture and controls can interrupt plausible paths supported by evidence.

14. What We Still Do Not Know

A mature CTI investigation must also end with its limitations. The biggest gap for Chile is attribution transparency. There is a strong signal of Qilin involvement in government incidents and OIV/PSE entities, but the affected organizations remain anonymous or are not publicly linked in an unequivocal manner. Without incident reports, ransom notes, hashes, VPN telemetry, EDR timelines, or direct statements, these cases cannot responsibly be converted into a named list of “confirmed” victims, even though on the dark side we can see that several of them are in fact confirmed.

It is also not publicly possible to determine which affiliate or cluster was behind Valbifrut, Ducasse, Conectados, Graneles, NOI, Clínica Maitenes, or AGUNSA. A common DLS does not imply a common intrusion set. The RaaS model specifically decouples the ransomware brand from the intrusion operator.

The Moonstone Sleet-Qilin relationship requires the same caution. Public evidence supports limited use or association, not that Qilin is controlled by a North Korean actor or that its usual affiliates are state-sponsored.

The 2025-2026 figures cannot be strictly compared across vendors either. For an Intelligence Engineering program, each dataset should preserve source_dataset, collection_date, listing_date, status, and deduplication rules. Collapsing all trackers into a single counter removes context and can manufacture trends.

Finally, there is no local denominator for exposure: prevalence of VPNs without MFA, legacy appliances, Veeam/vCenter reachable from AD, RMM concentration, infostealer credentials, or vulnerable-driver controls in Chilean organizations. Without those data points, it is not possible to calculate a serious quantitative national probability. It is possible, however, to identify the surfaces with the highest defensive return.

15. Conclusion: Chile Does Not Need to Wait for a Confirmed Victim to Act

The most useful way to understand Qilin in 2026 is not as a specific malware family, but as a distributed criminal system that converts different forms of access into a recurring chain toward identity, administrative control, data, and recovery capability.

Qilin has evolved from the Agenda lineage observed in 2022 into a RaaS operation with Windows/Linux/ESXi support, heterogeneous affiliates, double extortion, and significantly more sophisticated defense evasion. But its operational strength is not only in the code. It lies in the ability to exploit credentials, appliances, Active Directory, legitimate tools, RMM, backups, and virtualization as parts of a single attack system.

For Chile, the available evidence allows us to state with high confidence that the threat is real and relevant. There is a strategically significant incident attributed at an early stage, aggregated information about government incidents, and a growing sequence of named claims across multiple sectors. What does not exist publicly is sufficient evidence to call every organization published on the DLS a “confirmed victim.” Preserving that distinction does not weaken the analysis; it makes it more useful.

The defensive implication is direct: the objective should not be to detect “Qilin.exe.” It should be to break the chain before the ransomware arrives. Remote access, identity, Tier-0, GPO/SYSVOL, lateral movement, EDR resilience, exfiltration, backup, and VMware are the points where an organization can still change the outcome.

It is also an architecture lesson. An EDR can be neutralized; a backup can exist while still sharing the same trust plane; a vCenter can concentrate the availability of dozens of services; a VPN can be patched and remain risky if identity is weak; a DLS can be useful while still being insufficient to confirm victimology.

Qilin should be treated in Chile as an identity-compromise and control-plane-compromise scenario that ends in ransomware. Encryption is the visible impact; the ability to prevent it is decided much earlier.

The question for a CISO is not whether Qilin will appear with the same hash, the same tool, or the same affiliate. It is whether, when an actor finds a valid credential, a vulnerable appliance, or a remote integration, the current architecture can prevent that access from turning into authority over Active Directory, backups, virtualization, and data.

That is the difference between knowing a ransomware family and understanding the threat as a system.