Qilin
Software · ATTACK:enterprise:S1242
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1242",
"title": "Qilin",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1242",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e23d2777-b85d-44fc-861e-9149d399fbb9",
"external_id": "S1242",
"domain": "enterprise",
"created": "2025-09-26T19:18:39.227Z",
"modified": "2026-04-23T03:12:30.298Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Agenda"
},
{
"source_name": "Sophos Qilin MSP APR 2025",
"url": "https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"
},
{
"source_name": "Trend Micro Agenda Ransomware AUG 2022",
"url": "https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"
},
{
"source_name": "SentinelOne Qilin NOV 2022",
"url": "https://www.sentinelone.com/anthology/agenda-qilin/"
},
{
"source_name": "BushidoToken Qilin RaaS JUN 2024",
"url": "https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"
},
{
"source_name": "Trend Micro Agenda Ransomware OCT 2025",
"url": "https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"
}
]
}Explicit source assertions (54)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0059d5e7-7a7f-4a13-8730-00383bad2e98
HC3 Qilin Threat Profile JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60
Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a068599-574d-4df3-8b05-6194e7366cc4
Picus Qilin MAR 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--158e6f8e-cd86-4945-b962-14d60000bf60
Halcyon Qilin.B OCT 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--170c9b30-c055-494d-98a4-00d9ce5b4864
Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:S1242
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c4f833c-496f-4da0-ba46-e1b0ed106284
MIcrosoft Moonstone Sleet Qilin MAR 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1caaad2f-7a84-4e32-8134-edac0c4fcc72
Picus Qilin MAR 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f377784-3676-4df3-8a29-7b3372a5d8ba
Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f2f5731-3c6c-4c08-a39a-2afa45f3bc9c
Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3071d81a-db65-4324-b280-b53dccca56b6
Halcyon Qilin.B OCT 2024 · HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--358466fb-c847-4f14-b5cc-c368df25932b
Sophos Qilin MSP APR 2025 · SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dd85bcc-faab-43a0-99d4-9b269e69f2e7
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41b41a39-ff5f-433d-9e2a-3dad3b00d74e
Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47131d16-bc98-4883-913f-1277066eb9a0
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1673
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52ff76ae-5f22-40d6-9bdf-006e9df75fc9
Halcyon Qilin.B OCT 2024 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--580d04a7-791b-42a9-87cc-d3bfbca45d7e
Picus Qilin MAR 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c39581b-cf62-4b14-bce2-9efbcf46440b
Picus Qilin MAR 2025 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--602d3c1d-6337-4134-9dc7-b1452f95b88f
Picus Qilin MAR 2025 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62363450-709a-4b52-a07d-2bf0c2f7dd8e
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69a36e50-f8a7-4604-8610-d080f8e469d4
Halcyon Qilin.B OCT 2024 · HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022 · Cisco Talos Qilin Ransomware OCT 2025 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b0992a5-5800-44b2-906b-23d9a7985d22
Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025 · BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20
Picus Qilin MAR 2025 · Halcyon Qilin.B OCT 2024 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e1fe223-d295-4784-b64a-2e2b6586b782
Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eb9c742-7eab-4eef-9036-d9af96dbafb4
Sophos Qilin MSP APR 2025 · Halcyon Qilin.B OCT 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7120230b-c8b3-4e70-a9a9-9edd2214ef09
HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--731fd895-2b35-4ac4-a16c-f85340543595
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--749496af-4629-431d-829c-4615b9f41fe5
Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76f5cf4b-15c0-4aa5-b129-68b3b248e90d
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--798d8217-a605-450c-9634-2297adcd227e
Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:G1050 → uses → ATTACK:enterprise:S1242
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79d29087-54fd-4e26-a961-558174b623f0
BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ac60f16-6b9a-4226-af16-b486f5085f71
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80fdd3cb-a3c0-46a2-9331-03b2beaba181
Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85e94a33-82be-46f4-b6e5-766f5f5e5a56
Halcyon Qilin.B OCT 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1222
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87ddd67f-3c7f-4d69-b9e4-c2526a3d609f
Picus Qilin MAR 2025 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89b2422c-6b9a-479c-bb07-52e73967066a
Picus Qilin MAR 2025 · Halcyon Qilin.B OCT 2024 · HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022 · Cisco Talos Qilin Ransomware OCT 2025 · BushidoToken Qilin RaaS JUN 2024 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f8d7305-96e8-46c9-8fb9-1a1b85c8fbe5
Sophos Qilin MSP APR 2025 · SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96295901-89c2-4646-b18f-3d2eeec651ba
SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2aaa018-7bcc-4ec1-b27e-c6672e390c32
Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a60bfbb3-243d-4706-923f-a084ae3a51db
Trend Micro Agenda Ransomware AUG 2022 · BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a87ca5db-1a5c-433a-a945-4fe74a883c4d
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab867547-6229-4f9f-9b0d-4ebdbca49d1d
Picus Qilin MAR 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba59907a-1a0c-4150-93a6-53581bffd08d
Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c60596a4-8947-4e43-8a4a-05bb5826d0fd
SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c85dc67b-42f9-4fdd-a91c-7fc24ef4c9fe
Trend Micro Agenda Ransomware AUG 2022 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6c69c31-f292-4939-82e2-addbd84604e9
Trend Micro Agenda Ransomware AUG 2022 · BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbe9c675-61d0-43c3-ad77-6c511fdc46b9
Picus Qilin MAR 2025 · Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de93ce86-0bf9-4959-ab2b-b55df654b9f8
Sophos Qilin MSP APR 2025 · Picus Qilin MAR 2025 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e00219f2-3915-47db-a9fb-25c97a81e745
SentinelOne Qilin NOV 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e506d4d7-c214-436c-a876-7ff2c71fcc87
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eebb9c93-2d18-4b27-92aa-b7e597c27616
Sophos Qilin MSP APR 2025 · Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f34665d9-96d4-4c11-92a8-b2f1d4945a50
Sophos Qilin MSP APR 2025 · Halcyon Qilin.B OCT 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f889a92b-6071-4b34-b799-782dff1798d1
Sophos Qilin MSP APR 2025 · Cisco Talos Qilin Ransomware OCT 2025 · Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9dadb46-4517-4b5c-897a-20628a9b3e98
Picus Qilin MAR 2025 · Cisco Talos Qilin Ransomware OCT 2025 · BushidoToken Qilin RaaS JUN 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff972951-9c3f-43f3-aa44-857f2b4452e9
Trend Micro Agenda Ransomware OCT 2025