Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Acronis details Qilin ransomware attacks on ESXi and healthcare

Part of the Qilin story · since 18 Sep 2025

Developinglatest 2 hours ago36 articles11 outlets
18 Sep · GBHackers first9 Apr17 Jun25 AugNowThis article36th of 36
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare. This article, 36th of 36.

Acronis Threat Research Unit has analysed a Rust-based Qilin ransomware build after the group claimed more than 1,000 victims in 2025 and over 900 additional victims in 2026. The operation, attributed to a Russian-speaking RaaS network linked to Moonstone Sleet and Securotrop, targets Windows systems, network shares and VMware ESXi hypervisors.

Healthcare remains a notable sector within the victim set, accounting for about 13.3 per cent of confirmed targets, with a high-profile June 2024 incident on UK pathology provider Synnovis exposing data on about 900,000 people and disrupting hundreds of hospital operations. The attackers are accused of causing roughly $44 million in damages and pressing a $50 million ransom demand.

Affiliates breach networks via spear-phishing, stolen VPN or RDP credentials, unpatched public apps and remote administration tools, and the group is said to publish stolen data on both Tor and the clearnet WikiLeaksV2 portal to pressure victims.

Technically, the analysed Windows payload is a 4.69 MB 32-bit executable written in Rust, with 6,598 functions and 28 command-line switches. A password flag is required at launch to defeat automated analysis, with the supplied password hashed by SHA-256 and accepted only if it matches a hardcoded 64-character digest. When run with administrative rights, the malware elevates privileges, impersonates tokens and can duplicate other users’ security tokens.

It disables databases, backup agents and security services listed in its JSON configuration, checks for virtualisation via CPUID, and, when configured for ESXi, executes an embedded PowerShell script that installs the .NET Framework and NuGet, modifies VMware PowerCLI settings, disables cluster services, lists ESXi hosts, resets root passwords, enables SSH and uploads Linux encryptors to the hypervisors.

On Windows, it prepends a six-letter autorun key, enables extended symbolic-link evaluation, deletes VSS shadows, and selects AES-NI or ChaCha20 based on processor support. Each file is encrypted with a random 32-byte key wrapped by a hardcoded RSA-4096 public key, with per-thread logs collected in a QLOGS[.]zip for exfiltration. The ransom note provides Tor portal credentials, while data is also posted on WikiLeaksV2 as part of the double-extortion tactic.

Researchers advise monitoring for fsutil-based symbolic-link activity, restricting PowerShell and PowerCLI, disabling SSH on ESXi, and maintaining offline backups outside AD trust boundaries.

How the story developed

All 36 articles
Developinglatest 2 hours ago36 articles11 outlets

36 articles from 11 outlets since 18 Sep. Picked up again today after 9 days quiet. This was the 36th report, 407 days after the first.

Now18 Sep4251827 Mar2219302517526First reportGBHackers · 18 Sep, 13:36This article36th of 36 · day 407Exploited CVEDark Reading · 8 Jun
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare. This article, 36th of 36.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 36 articles as a list
  1. Thu 18 SepDay 01
    1. Qilin Ransomware Attack Impacts 104 Organizations in August13:36 · GBHackers · First report

  2. Quiet for 3 weeks

    Wed 8 OctDay 203
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · Picked up again
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches

  3. Quiet for 11 weeks

    Tue 23 DecDay 961
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  4. Quiet for 14 weeks

    Tue 31 MarDay 1941
    1. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc08:06 · Security Affairs · Picked up again

  5. Quiet for 4 days

    Sat 4 AprDay 1981
    1. Qilin Ransomware Claims Data Theft from German Party Die Linke18:10 · Security Affairs · Picked up again

  6. Quiet for 2 weeks

    Sun 19 AprDay 2131
    1. NHS Trust still using paper after Qilin ransomware hit Synnovis18:08 · DataBreaches · Picked up again

  7. Quiet for 3 weeks

    Mon 11 MayDay 2351
    1. Qilin Tops Ransomware List as Gentlemen Surge in Q1 202610:27 · Check Point · Picked up again

  8. Quiet for 3 weeks

    Wed 3 JunDay 2581
    1. Brazil faces surge in ransomware as top threat actors target 202612:06 · SOCRadar · Picked up again

  9. Quiet for 5 days

    Mon 8 JunDay 2631
    1. Check Point warns of IKEv1 flaw linked to Qilin ransomware20:57 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE
  10. Tue 9 JunDay 2643
    1. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks09:50 · SecurityWeek · Known exploited CVE
    2. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild09:50 · Infosecurity · Known exploited CVE
    3. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN12:31 · DataBreaches · Known exploited CVE

  11. Quiet for 3 weeks

    Fri 3 JulDay 2881
    1. Qilin Tops Ransomware Market Rising Competition, Analysts Say13:11 · Infosecurity · Picked up again

  12. Quiet for 3 weeks

    Tue 21 JulDay 3063
    1. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall03:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin ransomware exploits PAN-OS auth bypass to breach networks14:10 · The Hacker News
    3. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN17:01 · Security Affairs · Known exploited CVE

  13. Quiet for 2 days

    Thu 23 JulDay 3081
    1. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass09:09 · SecurityWeek · Known exploited CVE

  14. Quiet for 4 days

    Mon 27 JulDay 3121
    1. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations07:12 · Security Affairs · Picked up again

  15. Quiet for 4 days

    Fri 31 JulDay 3161
    1. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 202617:20 · DataBreaches · Picked up again

  16. Quiet for 7 days

    Fri 7 AugDay 3231
    1. Ransomware Surges in July After Q2 Lull08:31 · Infosecurity · Picked up again

  17. Quiet for 3 days

    Mon 10 AugDay 3261
    1. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge10:17 · Securelist · Picked up again

  18. Quiet for 2 weeks

    Thu 27 AugDay 3431
    1. Qilin ransomware claims ATF hack, agency says breach isolated17:25 · DataBreaches · Picked up again
  19. Fri 28 AugDay 3441
    1. ATF calls Qilin ransomware breach a major incident14:18 · SecurityWeek

  20. Quiet for 13 days

    Thu 10 SepDay 3571
    1. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Picked up again · Known exploited CVE
  21. Fri 11 SepDay 3581
    1. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE

  22. Quiet for 4 weeks

    Tue 6 OctDay 3831
    1. Japan Extradites Suspected Qilin Ransomware Member to Germany12:29 · DataBreaches · Picked up again
  23. Wed 7 OctDay 3841
    1. Alleged Qilin ransomware operator extradited from Japan to Germany13:54 · SecurityWeek · Known exploited CVE

  24. Quiet for 2 days

    Fri 9 OctDay 3861
    1. Germany Arrests Suspected Qilin Ransomware Leader After Extradition20:00 · Security Affairs · Picked up again

  25. Quiet for 3 days

    Mon 12 OctDay 3891
    1. Ransomware gangs exploit Palo Alto VPN flaw months after patch release09:46 · Infosecurity · Picked up again · Known exploited CVE

  26. Quiet for 8 days

    Tue 20 OctDay 3973
    1. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
    3. Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE
  27. Wed 21 OctDay 3981
    1. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption12:22 · Infosecurity

  28. Quiet for 9 days

    Fri 30 OctDay 4071
    1. Acronis details Qilin ransomware attacks on ESXi and healthcare07:00 · SecurityOnline · Picked up again · This article, 36th of 36

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in