Qilin Ransomware Recovery: What's Recoverable

Qilin has been active since mid-2022, operating a double-extortion model — demanding payment for both decryption and suppression of exfiltrated data. It's written in Go, with a Rust-based Qilin.B variant introduced in October 2024 adding stronger obfuscation, and uses ChaCha20 encryption with RSA-4096 key protection.

Alongside Windows and Linux, Qilin explicitly targets VMware ESXi environments. Entry is typically via compromised VPN/RDP credentials or public-facing application exploitation, followed by credential theft from browsers on domain-joined machines and lateral movement via RDP and SMB — the technique used in the June 2024 Synnovis NHS attack, which caused over 10,000 appointment cancellations.

An ESXi-targeting variant matters specifically for datastore- and VMDK-level recovery: depending on how completely a host's datastore was encrypted, individual virtual disks can sometimes still yield recoverable content even when the guest VM itself won't boot. This is why imaging the underlying storage and assessing at the VMFS/VMDK level — rather than only checking whether VMs power on — is the right first step.