202406181500_Qilin Threat Profile_TLPCLEAR

[TLP:CLEAR, ID# 202406181500, ]

U.S. Department of Health and Human Services

Health Sector Cybersecurity Coordination Center (HC3) www.HHS.GOV/HC3

HC3: Threat Profile

June 18, 2024 TLP:CLEAR Report: 202406181500

Qilin, aka Agenda Ransomware

Executive Summary

Qilin is a ransomware-as-a-service (RaaS) offering in operation since 2022, and which continues to target healthcare organizations and other industries worldwide. The group likely originates from Russia, and was recently observed recruiting affiliates in late 2023. The ransomware has variants written in Golang and Rust, and is known to gain initial access through spear phishing, as well as leverage Remote Monitoring and Management (RMM) and…