OTX Threat: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion

Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims. The operation employs a flexible platform allowing affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure. Affiliates typically gain initial access through phish Sectors: Healthcare