VULNpocalypse
MediumEcosystem changeMonitoring

Qilin ransomware: Seqrite reports 2026 variant adds ESXi and AD spreading

Seqrite reports a 2026 Qilin ransomware variant that automates AD, PsExec and ESXi spreading. Watch for Safe Mode boot changes and RSAT installs.

Published
Exploitation
Not confirmed, Seqrite reports observed Qilin incidents in several sectors but names no victims and no exploited CVE

What happened

Security vendor Seqrite reports that it reverse engineered two Qilin (Agenda) ransomware samples, a March 2026 baseline and an October 2026 variant. It says the malware shifted from a manually driven tool to an automated payload Seqrite. This is a single vendor analysis. Independent verification is not confirmed. The excerpt reviewed names no specific victims and no CVEs.

According to Seqrite, the baseline sample runs in eight phases:

  • It checks an operator-supplied SHA-256 campaign password (--password) before doing anything else.
  • It checks for elevated privileges and profiles the hypervisor.
  • It picks hardware AES-256-CTR when AES-NI is present and falls back to ChaCha20 when it is not.
  • It reads an embedded JSON configuration.
  • It stops 5 services and kills 41 processes.
  • It encrypts files, deletes Volume Shadow Copies through vssadmin and WMIC, and drops ransom notes.

Seqrite also reports the following about encryption Seqrite:

  • It is intermittent, encrypting periodic 1 MB blocks.
  • It appends a random 10-character extension to each file.
  • Session keys are wrapped with an embedded RSA-4096 public key.
  • System directories and .exe, .dll and .sys files are skipped.

Seqrite says the October 2026 variant adds these features Seqrite:

  • Restart Manager use: It calls the Windows Restart Manager API (rstrtmgr.dll) to release locked files, which Seqrite says enables encryption of SQL Server, Exchange and virtual machine disk files.
  • vCenter and ESXi suite: An embedded PowerShell suite (--spread-vcenter) logs in to vCenter and disables HA and DRS. It then uploads Linux ELF payloads to /tmp/ on ESXi hosts over SSH/SCP, powers down VMs with esxcli and encrypts .vmdk volumes.
  • Active Directory discovery: It installs the RSAT Active Directory module in the background with DISM, then runs Get-ADComputer and ICMP pings to build target lists.
  • PsExec spreading: Embedded 32-bit and 64-bit PsExec binaries deploy the malware over ADMIN$ and C$ using harvested credentials.
  • Safe Mode reboot: It sets bcdedit.exe /set {current} safeboot minimal (or network) and changes Winlogon AutoAdminLogon so that, as Seqrite reports, the host reboots into Safe Mode where third-party EDR drivers do not load.
  • Printer notes: It scans for TCP port 9100 and sends ransom notes to network printers.
  • Command line: The 6 basic arguments grew to a 42-switch command line.
  • Self-deletion: It deletes itself after encryption with a cmd.exe timeout and Del command.
  • Masquerading: It poses as resmon.exe with a forged Microsoft Code Signing PCA 2011 signature overlay. Seqrite says the code is now a modular Rust workspace with 22 internal crates.

Seqrite says its telemetry shows attacks against the healthcare, manufacturing, education and technology sectors. Victim counts, initial access method and any published indicators of compromise are not confirmed in the excerpt reviewed Seqrite.

Am I affected?

Not confirmed for any specific organisation. Seqrite does not link the behaviour to a software vulnerability, so there is no version to check. Based on Seqrite’s description, these environments match the variant’s targeting Seqrite:

  • Windows hosts joined to Active Directory
  • VMware vCenter and ESXi estates
  • Servers running SQL Server or Exchange

What to do now

The steps below are detection checks that follow from the behaviours Seqrite describes. They are not recommendations published by Seqrite.

  1. Alert on bcdedit changes that set safeboot, and on Winlogon AutoAdminLogon registry changes, on servers and workstations.
  2. Flag background DISM installs of Rsat.ActiveDirectory.DirectoryServices on hosts that are not admin workstations.
  3. Monitor for PsExec-style service creation and file writes to ADMIN$ and C$ from unexpected sources.
  4. In vCenter, alert when HA or DRS is disabled. On ESXi, alert on new SSH sessions and executables written to /tmp/.
  5. Look for resmon.exe running outside its normal Windows path or carrying an invalid signature.
  6. Review traffic from workstations or servers to TCP port 9100 on printers.
  7. Alert on Volume Shadow Copy deletion via vssadmin or WMIC.
  8. Check Seqrite’s full report for sample hashes or other indicators. None are confirmed in the excerpt reviewed here.

Sources