Qilin: The Ransomware Group Behind the NHS Synnovis Attack and the Chrome Credential Theft Innovation

On 3 June 2024, Synnovis — the pathology partnership providing blood testing and transfusion services to several NHS hospital trusts in South East London — suffered a ransomware attack that would become the most clinically disruptive cyber incident in NHS history. Emergency blood transfusions were cancelled. Elective operations requiring specific blood groups were postponed. Patients were transferred to hospitals outside the affected trusts. NHS England declared a regional critical incident. The group responsible was Qilin.

Two years later, Qilin is still operating, has added a Chrome browser credential theft technique to its arsenal that the wider ransomware ecosystem subsequently adopted, and conducted a 2026 campaign simultaneously exploiting authentication bypasses in Check Point, Palo Alto, Fortinet, and F5 VPN infrastructure. The group’s trajectory — from obscure 2022 entrant to one of the most operationally sophisticated RaaS operations currently active — is worth understanding in detail.

Group Overview

The Agenda name reflects the group’s early operational style — customised ransom notes tailored to each victim that outlined a specific agenda of demands, deadlines, and escalation steps. When the group rebranded to Qilin, the operational sophistication increased significantly, including the Rust rewrite that dramatically expanded platform capability.

Origins and Evolution

Qilin was first documented by Trend Micro in August 2022, identified as Agenda — a Go-based ransomware family that appeared to have been written to order for specific targets, with each sample customised to include victim-specific credentials, IP addresses, and desired file extensions. This early customisation capability suggested either a technically sophisticated core team or a well-resourced affiliate providing bespoke builds.

The initial Go implementation targeted Windows and Linux. By 2023, the group had completed a significant codebase transition: a full rewrite in Rust, making Qilin one of the earliest ransomware operations to adopt Rust as its primary development language (alongside Cicada3301/Repellent Scorpius and the later stages of ALPHV/BlackCat development).

The Rust rewrite was not purely an operational choice. It delivered concrete technical advantages:

Cross-platform binary generation. The same Rust codebase produces native binaries for Windows, Linux (x64 and ARM), and — critically — VMware ESXi. The Go variant had supported ESXi; the Rust rewrite improved ESXi targeting with better enumeration and shutdown of virtual machines before encryption.

Nutanix AHV support. Qilin’s Rust encryptor added Nutanix AHV hypervisor targeting — a rare capability in the RaaS ecosystem. Nutanix competes with VMware ESXi in enterprise virtualisation, and many large organisations run Nutanix AHV clusters as their primary compute infrastructure. An encryptor that can target both platforms simultaneously covers the majority of enterprise virtualisation deployments.

Performance and detection evasion. Rust’s memory management model produces binaries that are structurally different from Go-compiled code, complicating static signature detection tuned for Go malware characteristics. Runtime behaviour — encryption speed, memory allocation patterns — also differs from Go variants, requiring updated detection content.

Technical Profile

Encryption scheme. Qilin uses ChaCha20 for file content encryption with a unique per-file key, and RSA-4096 for session key encapsulation. This is a standard and cryptographically sound construction — no known weaknesses in the implementation. The victim ID embedded in encrypted files and the ransom note enables the operator to correlate victims to the correct decryption portal.

Intermittent encryption. Like RansomHub and other modern RaaS encryptors, Qilin implements intermittent encryption for large files — encrypting the first and last blocks of large files, and full blocks at regular intervals, rather than the complete file. This trades a small window of data recoverability (in practice, files are unusable without the full decryption key) for dramatically faster encryption completion. An affiliate can encrypt an entire VMware ESXi VMDK library in a fraction of the time required for full-file encryption.

ESXi targeting. The Linux/ESXi variant uses esxcli and vim-cmd ESXi management commands to enumerate running virtual machines, terminate them, and then encrypt the underlying VMDK, NVRAM, and snapshot files. A single ESXi host compromise — which often requires only one set of obtained credentials — can encrypt the entire virtualised server estate that host supports.

Nutanix AHV targeting. Qilin’s Nutanix support involves targeting .qcow2 virtual disk files and the Nutanix cluster file system (NDFS). The operator enumerates available Storage Containers and systematically encrypts virtual disk images across the cluster.

Windows encryptor capabilities. The Windows variant terminates a configurable list of processes and services before encryption (including backup software, database services, and security agents), deletes Volume Shadow Copies via vssadmin.exe and wmic, and encrypts accessible network shares. Encrypted files receive a randomised extension configured at build time.

Configurable build parameters. Qilin’s encryptor builder allows affiliates to configure the victim-specific extension, exclusion lists (file types, directories, and drives to skip), process and service termination lists, and whether to execute pre-encryption scripts — including the Chrome credential theft script documented in the NHS Synnovis response.

The Chrome Credential Theft Technique

The most technically innovative development in Qilin’s operational history is the credential harvesting technique documented by Sophos X-Ops researchers during the NHS Synnovis incident investigation.

In traditional ransomware intrusions, credential theft occurs during the post-compromise reconnaissance phase using tools such as Mimikatz (LSASS dump) or DCSync against domain controllers. These techniques target Windows credential stores and Active Directory. Qilin affiliates added a complementary technique: systematic extraction of credentials stored in Chrome browser profiles on compromised endpoints.

The technique works as follows. A PowerShell script is deployed via Group Policy to all domain-joined machines. The script copies the Chrome Login Data SQLite database and associated encryption key material (Local State) from each user’s profile directory, decrypts the stored passwords using the DPAPI master key (accessible once running with user-level privileges), and stages the extracted credentials for exfiltration.

The significance is the credential scope. Chrome’s saved password store on an enterprise endpoint typically contains not just web application credentials, but VPN credentials, cloud console passwords, SaaS application logins, and credentials for internal applications that employees have saved in the browser. In environments where password manager adoption is incomplete — which describes most enterprise environments — Chrome represents the largest single store of valid user credentials available from a compromised endpoint.

For an affiliate conducting a Qilin attack, the Chrome credential harvest provides:

• Domain credentials that may not have been captured in LSASS (users who log into web-based internal applications without cached Windows credentials)
• Cloud console access — AWS Management Console, Azure portal, GCP — stored as browser passwords that can be used to access cloud infrastructure independently of the compromised on-premises network
• SaaS platform access — Salesforce, ServiceNow, SharePoint Online — providing data exfiltration paths through legitimate platforms even if on-premises data is encrypted
• VPN credentials for re-entry following detection and remediation

The technique is now documented in Group Policy Objects on systems responding to Qilin incidents: a logon script that executes the Chrome harvesting PowerShell before cleanup, ensuring credentials are exfiltrated even if other aspects of the intrusion are detected. Sophos researchers assessed that the Chrome credential theft may have been designed specifically to facilitate persistence in environments that rapidly detect and respond to ransomware — providing the affiliate with credentials to re-enter even after incident response.

Several other ransomware affiliates have since added browser credential theft components to their toolkits, citing Qilin’s 2024 documentation of the technique.

The NHS Synnovis Attack

The 3 June 2024 Synnovis attack is the defining incident in Qilin’s operational history and one of the most clinically consequential ransomware attacks in UK healthcare history.

Synnovis is the joint venture between Synlab UK and two NHS foundation trusts — King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation Trust — providing pathology services including blood testing, transfusion support, and diagnostic services for multiple NHS trusts across South East London.

The Qilin affiliates accessed Synnovis systems via a VPN appliance using a compromised credential from an account without multi-factor authentication enabled. Once inside, the intrusion followed a standard dwell-and-pivot pattern: Active Directory enumeration, lateral movement to high-value servers, data exfiltration over several days, and ransomware deployment timed for the early hours of 3 June.

The clinical impact was immediate and severe:

• Blood matching suspended. Synnovis systems provide real-time blood group matching for transfusions. With systems encrypted, hospitals were unable to perform rapid blood group matching, forcing use of universal donor blood (O-negative) — a limited supply that must be conserved for emergency trauma cases.
• Elective surgery cancellations. Operations requiring specific blood groups or perioperative blood testing were cancelled for weeks. NHS England reported over 1,000 elective procedures cancelled in the three weeks following the attack.
• Blood test processing disrupted. Routine blood tests — liver function, kidney function, diabetes monitoring, infection markers — could not be processed at the normal volume, affecting outpatient care across the affected trusts.
• Regional critical incident declared. NHS England South East London declared a critical incident, activating emergency protocols and requesting NHS Blood and Transplant to increase supply to affected hospitals.

Qilin published 400GB of patient data on its dark web leak site after Synnovis declined to pay the ransom, including patient blood test results, referral information, and details of 300 million patient-GP interactions. NHS England worked with the NCSC and NHSX to investigate the breach; CISA and the NCSC issued joint advisory guidance on ransomware targeting healthcare following the incident.

The Synnovis attack demonstrated that healthcare ransomware incidents are not merely financial or data breach events — they carry direct patient safety consequences that justify treating ransomware defence as a patient safety priority, not an IT risk management issue.

Affiliate Model and Dark Web Presence

Qilin operates a standard RaaS affiliate model with a dark web recruitment and management portal. The commission structure has varied over time and by affiliate tier:

Qilin’s dark web leak site operates a staged publication model: victims are listed with a countdown timer before data publication, providing leverage during negotiation. Data categories are listed with file counts to demonstrate the scope of exfiltration without publishing the full dataset — a now-standard pressure tactic.

Affiliate recruitment posts on cybercrime forums emphasise the multi-platform capability and the quality of the affiliate portal. Qilin’s panel provides affiliates with an encryptor builder, victim management, negotiation chat, and data leak management — a comparable feature set to the leading RaaS platforms.

One documented consequence of Qilin’s operational posture: a disgruntled affiliate who left the Qilin programme launched The Gentlemen ransomware group in late 2025, explicitly positioning it as a competitor with a more affiliate-friendly commission structure. The Gentlemen has since become one of the most active groups globally. The episode illustrates both the talent mobility in the RaaS ecosystem and the consequence of affiliate dissatisfaction — experienced operators who leave take their access, tradecraft, and victim targeting knowledge with them.

2026 VPN Exploitation Campaign

In May-June 2026, a Qilin affiliate conducted the most aggressive multi-vendor VPN exploitation campaign publicly documented in the ransomware ecosystem.

The campaign simultaneously exploited authentication bypass vulnerabilities in four major enterprise VPN and network security platforms:

• Check Point Security Gateway — CVE-2026-50751 (CVSS 9.3), a logic error in legacy IKEv1 certificate validation allowing VPN access without user credentials. Exploitation began 7 May 2026 — a full month before Check Point published its advisory on 4 June and patch on 8 June. This was a zero-day for the entire exploitation window.
• Palo Alto Networks PAN-OS GlobalProtect — CVE-2026-0257, authentication bypass in GlobalProtect SSL VPN. Exploited in the same campaign infrastructure.
• Fortinet — Exploitation of FortiGate vulnerabilities (multiple CVEs from 2025 and 2026) in the same affiliate’s toolset.
• F5 BIG-IP — APM (Access Policy Manager) authentication bypass vulnerabilities.

The multi-vendor scope is the analytically significant element. The same Sliver command-and-control framework, the same Rclone exfiltration infrastructure, and the same attacker infrastructure (Kaupo Cloud HK, Shock Hosting, Vultr) appeared across intrusions originating via all four platforms. This is not an affiliate that purchased a single CVE and targeted one vendor’s install base — it is a systematic strategy of blanketing all major enterprise perimeter targets simultaneously, maximising the addressable target space from a single exploitation capability.

CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities catalogue on 8 June 2026 with a remediation deadline of 11 June — one of the shortest KEV windows issued, reflecting the active exploitation scale.

Post-access activity across documented Qilin incidents in this campaign:

1. Sliver framework deployed for persistent C2 and lateral movement
2. Active Directory enumeration (ADFind, BloodHound)
3. Credential dumping (LSASS, Chrome credential harvest via PowerShell GPO)
4. Data staging and Rclone exfiltration to cloud storage
5. Ransomware deployment against Linux, ESXi, and Nutanix environments
6. In several cases, destruction of backup infrastructure before encryption

Intrusion Pattern: Common TTPs

Across documented Qilin incidents from 2024-2026, consistent TTP patterns emerge:

Initial access. Primarily VPN appliance exploitation using either purchased initial access broker credentials or direct vulnerability exploitation. MFA absence on VPN accounts is a prerequisite for credential-based access. The 2026 campaign shifted to direct authentication bypass exploitation, removing the MFA dependency.

Persistence. Group Policy is used to deploy persistence and tools across the domain once admin-level access is obtained — including the Chrome credential harvesting script. Scheduled tasks and service creation for individual host persistence.

Discovery. ADFind and BloodHound/SharpHound for Active Directory enumeration. Network scanning to identify ESXi hosts, Nutanix clusters, backup servers, and file servers. Hypervisor management interfaces are priority targets once domain credentials are obtained.

Lateral movement. PsExec, RDP, and WMI are the primary lateral movement tools. Sliver provides interactive operator access during the exfiltration phase. Affiliates prioritise reaching ESXi and Nutanix management hosts before deploying ransomware.

Exfiltration. Rclone is the primary exfiltration tool, staging data to attacker-controlled cloud storage (in documented incidents: Mega.nz and dedicated Rclone remote endpoints). Data is typically exfiltrated over one to three days before encryption.

Encryption deployment. Domain-wide via PsExec or Group Policy for Windows. ESXi and Nutanix encryption conducted via direct management access to hypervisors. Deployment is timed for weekends or overnight. Volume Shadow Copies deleted on Windows hosts.

Defensive Priorities

Patch VPN appliances immediately. Qilin’s 2026 campaign exploited vulnerabilities across Check Point, Palo Alto, Fortinet, and F5 in a single campaign. The month-long zero-day window on CVE-2026-50751 means organisations that did not patch within hours of the 4 June advisory were potentially compromised during the window. VPN appliance patching must be treated with the same urgency as domain controller patching — these are the primary entry point for ransomware affiliates.

Enforce MFA on all VPN access. The NHS Synnovis initial access was via a VPN account without MFA. This remains the most common single control failure that enables ransomware intrusions via VPN. Enforcing MFA — particularly phishing-resistant MFA (hardware keys, passkeys) rather than TOTP — closes the credential theft initial access path entirely.

Monitor Chrome credential stores. Deploy detection for access to Chrome’s Login Data database and Local State files from processes other than Chrome. PowerShell or script execution that copies these files to staging locations is a high-confidence indicator of Qilin (or copycat) credential theft. Most EDR platforms can detect this access pattern.

Protect ESXi and Nutanix management interfaces. ESXi management (port 443, HTTPS console, SSH) and Nutanix Prism Central should not be accessible from general enterprise networks. Network segmentation that restricts hypervisor management to a dedicated management VLAN accessible only from designated management hosts dramatically limits the blast radius of a domain compromise.

Backup infrastructure isolation. Qilin affiliates specifically target backup servers in the pre-encryption phase. Backups accessible via domain credentials are not reliable recovery mechanisms. Immutable backups in offline or separately authenticated environments are the prerequisite for ransomware recovery without payment.

Healthcare-specific: Following Synnovis, the NCSC and NHS England issued guidance specifically addressing NHS trust ransomware preparedness, including requirements for offline operational continuity plans for critical clinical systems. Healthcare organisations should test whether operations can continue in a manual/paper mode for the systems most critical to patient safety — blood transfusion, electronic prescribing, patient record access — since complete system restoration after a ransomware incident takes days to weeks.

Qilin is not a static operation. The Chrome credential theft technique was an innovation that the group developed and that others adopted. The multi-vendor VPN exploitation campaign in 2026 demonstrated operational sophistication beyond most RaaS affiliates. The Rust rewrite brought Nutanix targeting to the ransomware ecosystem. Each development reflects an operation that continues to evolve its capability, making historical exposure or control assessments a poor guide to current risk.