Qilin Ransomware: What to Do First, and Why It's a Breach Question

What should I do right now if I see a Qilin ransom note?

Pull the network cable or turn off Wi-Fi on every machine showing the note, and leave those machines powered on. Don’t pay, don’t reply to the attackers, and don’t wipe or rebuild anything. Call your IT provider from a personal phone, then your cyber insurance carrier, then report it to the FBI.

In order:

1. Disconnect, don’t shut down. CISA’s #StopRansomware Guide says to unplug affected devices or take them off Wi-Fi, and to power a device down only if you can’t get it off the network. A running machine still holds evidence.
2. Don’t pay. The FBI says it “does not support paying a ransom,” and that paying “doesn’t guarantee” you get anything back. HHS’s Qilin profile says the same about this group’s decryptors.
3. Don’t clean up. Deleting the note, reimaging a PC, or running a free removal tool destroys the logs that tell you what was taken. That answer drives your breach notice decision.
4. Talk out of band. CISA warns attackers may watch your email and chat to see if they’ve been spotted. Use phones until IT says the network is clean.
5. Call your insurer early, before you hire outside help, so you know what your policy covers. Your incident response plan should have the number on page one.
6. Report it to the FBI’s IC3, whether or not you pay.
7. Reset passwords from a clean device, email and admin accounts first, once IT confirms the attacker is cut off.

What is Qilin ransomware?

Qilin is ransomware rented out to criminal “affiliates” who do the break-ins and split the money with the developers. The U.S. Department of Health and Human Services’ HC3 threat profile from June 18, 2024 says it launched as “Agenda” in July 2022, rebranded as Qilin by that September, and likely originates from Russia.

A few facts from that profile worth knowing:

• Affiliates use Qilin’s tools and infrastructure “in exchange for 15-20% of the proceeds.”
• The ransomware is written in Go and Rust, and mainly hits Windows. A Linux version that targets VMware ESXi servers showed up in December 2023.
• It practices double extortion. Victims are posted on a leak site, and the payment is to keep the data from going public.

It hasn’t slowed down. The FBI’s 2025 Internet Crime Report lists Qilin #2 among the ransomware variants most reported to IC3 in 2025, behind Akira. The FBI says that top 10 hit critical manufacturing, healthcare, and government facilities hardest. As of this writing, we found no law enforcement takedown and no joint CISA/FBI advisory on Qilin.

Who does Qilin go after?

Mostly whoever has an open door. HHS calls its targeting “opportunistic rather than targeted.” By leak-site count, manufacturing and professional services lead, and healthcare is a smaller share that does outsized damage. The industries that hold the most sensitive data are the ones that end up in the headlines.

The numbers, by source:

• HHS, June 2024: of more than 100 leak-site victims, manufacturing was about 21%, legal and professional services 15%, financial services 14%, and healthcare just over 7%. HHS counted at least 15 healthcare incidents worldwide since October 2022, about half in the U.S. The U.S. ones included dental clinics, a radiology company, a home health provider, a neurology center, and a cardiology clinic.
• Cisco Talos, October 2025: in its writeup of Qilin cases, Talos put manufacturing at about 23% and professional and scientific services at about 18%, with Qilin posting more than 40 victims a month in the second half of 2025.

The healthcare cases are the ones people remember. HHS notes that on June 3, 2024, Qilin hit a UK pathology and diagnostic services provider and disrupted services at several major London hospitals. If you run a medical practice, a small clinic is squarely in the victim profile.

How does Qilin get into a small office?

Through the same doors as everyone else: phishing emails, stolen passwords, and remote access left open. HHS lists spear phishing plus exposed Citrix and Remote Desktop (RDP). Both vendor writeups below came down to a VPN login with no second factor.

Two real cases, from the vendors who worked them:

• Sophos, July 2024. Sophos X-Ops described an intrusion that started with stolen credentials on a VPN portal that “lacked multifactor authentication.” The attackers sat quiet for 18 days, then used a Group Policy script to grab passwords saved in Chrome on every machine at logon. That’s every website login your staff saved, not just the network.
• Cisco Talos, October 2025. Talos assessed that attackers likely used admin credentials leaked on the dark web to log into a VPN that “had no multi-factor authentication (MFA) configured.” They copied data out with an ordinary file transfer tool, deleted Windows shadow copies, and went after backup software before encrypting.

Once inside, HHS says Qilin uses remote management tools and spreads with PsExec and SSH. That’s software that’s supposed to be on a network, which is why plain antivirus often misses it and EDR is the tool insurers ask about.

Is a Qilin attack a HIPAA or GLBA breach?

Usually you have to assume yes until an investigation says otherwise. Qilin copies data out before encrypting, and HHS’s ransomware guidance says that when ePHI is encrypted by ransomware, “a breach has occurred” and is presumed unless you can show a low probability the PHI was compromised.

That “low probability” has to come from a documented four-factor risk assessment. You can’t fill it out without logs. That’s another reason not to wipe machines in the first hour.

The clocks, by rule:

• HIPAA: notify affected patients “without unreasonable delay and in no case later than 60 calendar days after discovery” (45 CFR 164.404). You also notify HHS, and the media too if it’s over 500 people.
• GLBA / FTC Safeguards Rule: firms covered by the FTC rule, like mortgage brokers and tax preparers, must tell the FTC within 30 days of discovery when unencrypted data on 500 or more consumers is taken (16 CFR 314.4(j)).
• State law may add its own deadlines. That’s a question for your breach counsel.

We’re not your lawyer. What we can do is make sure the evidence exists to answer the question honestly.

How do I stop Qilin next time?

Close the doors the writeups describe, and keep a copy of your data the attacker can’t reach. For a 5-50 person office, that’s a short list. None of it is new. It’s the baseline we put in place as part of managed IT and security.

• MFA on every remote login. VPN, email, remote desktop gateways, admin accounts. Both vendor cases above were a VPN with no MFA. Use the phishing-resistant kind where you can.
• No RDP or Citrix open to the internet. We’ve found RDP exposed on a new client’s first day.
• Patch the edge first. Firewalls and VPN appliances face the internet. Both vendor cases above started at the VPN.
• Stop saving work passwords in the browser. Sophos recommends a real password manager instead.
• EDR with someone watching it. The alert at 2 a.m. only helps if a person reads it.
• One remote support tool. Remove the ones old vendors left behind.
• Offline, tested backups. HHS passes along the FBI’s advice to keep copies the infected system can’t modify or delete. Follow the 3-2-1 rule and test the restore.

Backups get your files back. They don’t un-steal them. That’s why prevention and backups both matter. The same list covers Akira and Medusa too.

Key takeaways

What this looks like when we do it

On our managed IT and security baseline, every machine gets EDR and 24/7 monitoring, MFA is enforced across the tenant, internet-facing RDP gets closed, and backups are kept and test-restored so recovery is a known quantity. For a medical practice, that ties back to the HIPAA documentation an auditor or insurer will ask for.

When something goes wrong, critical issues get a response in under 15 minutes. We isolate the affected machines, keep the evidence your breach counsel needs, and work with your insurer instead of around them.

Want to know how your office holds up against what Qilin actually does? Book a call and we’ll walk through it.