Qilin Ransomware in 2026: Evolution, Code Changes, and Tactics

Summary

Qilin ransomware has evolved from a manually operated command-line tool into a highly automated, modular payload written in Rust. Recent variants include automated Active Directory reconnaissance, lateral movement through PsExec, and dedicated modules for disrupting VMware ESXi hypervisors. The malware also uses advanced defense evasion techniques, including Safe Mode reboots intended to disable or bypass EDR sensors.

Investigation

The investigation compared two Qilin ransomware variants: a March 2026 baseline sample and a more advanced October 2026 version. Analysts used x32dbg to examine the malware’s eight-phase execution lifecycle, cryptographic negotiation through CPUID, and integration of the Windows Restart Manager API to unlock files before encryption.

Mitigation

Organizations should prioritize Active Directory security, disable unnecessary RSAT tools, and monitor for unauthorized execution of bcdedit.exe. Maintaining resilient backups and protecting VMware vCenter environments against suspicious SSH or SCP activity are also critical. In addition, monitoring unusual printer traffic over TCP port 9100 can provide a useful detection signal.

Response

When Qilin activity is detected, immediately isolate affected hosts to prevent lateral movement through PsExec or vCenter-related modules. Review Windows Event Logs for bcdedit changes and service termination activity. Conduct forensic analysis for unauthorized Rust-based binaries and investigate suspicious access to administrative shares across the environment.

Simulation Execution

• Attack Narrative & Commands: The adversary seeks to automate the disruption of VMware vCenter to prepare for a mass ransomware deployment. They utilize a specialized PowerShell script designed to disable High Availability (HA) to ensure that once encryption begins, the virtual machines cannot automatically restart on healthy hosts. To evade detection, the attacker originally used a script containing the specific identifier “PowerShell automation suite for VMware vCenter”. During this simulation, we will execute the command containing this string to confirm the rule triggers, and then demonstrate an immediate bypass by slightly altering the string.

• Regression Test Script:

  # PHASE 1: Trigger the Detection (The "Attack")
  Write-Host "[+] Executing command to trigger detection..." -ForegroundColor Cyan
  powershell.exe -ExecutionPolicy Bypass -Command "& {Write-Output 'Initializing: PowerShell automation suite for VMware vCenter'}"
  
  # PHASE 2: Demonstrate Evasion (The "Bypass")
  # This represents how a real attacker would evade the rule by simply changing one character.
  Write-Host "[+] Executing command to demonstrate evasion..." -ForegroundColor Yellow
  powershell.exe -ExecutionPolicy Bypass -Command "& {Write-Output 'Initializing: PowerShell Automation Suite for VMware vCenter'}" # Note the capital 'A' and 'S'

• Cleanup Commands:

  # No persistent changes were made during this simulation. 
  # However, if transcription files were created, they should be removed.
  Remove-Item -Path "$env:USERPROFILEDocumentsPowerShell_Transcript*.txt" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Green