Qilin ransomware, also known as Agenda, is a ransomware-as-a-service (RaaS) operation. In June 2026, affiliates exploited CVE-2026-0257 in PAN-OS for initial access. Post-exploitation activities varied, including encryption-only operations and double-extortion, with consistent use of PsExec, log clearing, and staging at C:PerfLogs.