Seqrite: reverse engineering of two Qilin builds shows the October 2026 variant adding a vCenter and ESXi spreading engine, Restart Manager lock release, a Safe Mode reboot loop and ransom notes printed to office printers
Qilin's October build spreads through vCenter and ESXi, reboots into Safe Mode and prints notes on office printers
Analysis
Seqrite's reverse engineering of a March 2026 and an October 2026 Qilin (Agenda) sample finds that the Rust code was reworked into a modular workspace of 22 internal crates, that the command line grew from 6 to 42 switches, and that the October build carries subsystems the baseline lacked (Seqrite Labs, 2026-11-03). It uses the Windows Restart Manager API to shut down the processes that lock SQL Server, Exchange and virtual-machine disk files, instead of the brute-force process termination of the March sample, so that the files can be encrypted (Seqrite Labs, 2026-11-03). An embedded PowerShell engine, started with --spread-vcenter, authenticates to vCenter, disables HA and DRS, extracts the ESXi host addresses, opens SSH and SCP sessions, uploads Linux ransomware payloads to /tmp on the hosts and runs esxcli to power off virtual machines and encrypt .vmdk volumes (Seqrite Labs, 2026-11-03).
The build also installs the RSAT Active Directory module itself with DISM before enumerating computers, embeds 32-bit and 64-bit PsExec to spread over the ADMIN$ and C$ shares with harvested credentials, and sets a Safe Mode boot with bcdedit plus an AutoAdminLogon registry value so that it reboots into Safe Mode, where EDR drivers do not load (Seqrite Labs, 2026-11-03). A raw-printing module scans local subnets for TCP port 9100 and sends cleartext ransom notes to office printers, and the October binary masquerades as resmon.exe with a forged Microsoft code-signing overlay (Seqrite Labs, 2026-11-03). Seqrite lists healthcare, manufacturing, education and technology as the victim sectors in its telemetry (Seqrite Labs, 2026-11-03).
Triage: the Restart Manager and a DISM-installed RSAT component are normal in patching and administration, so each is weak alone; the combination with the print fan-out, the Safe Mode change and the vCenter actions is the signal.
Cited evidence
the evolved binary contains a modular 20.8 KB PowerShell automation suite (–spread-vcenter). It authenticates to VMware vCenter servers, disables High Availability (HA) and Distributed Resource Scheduler (DRS), extracts ESXi hypervisor IP addresses, and establishes SSH/SCP sessions.
Detection of both Qilin strains is possible using static and behavior-based signatures, such as bcdedit Safe Mode modification and rstrtmgr.dll process termination.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.