SentinelOne VS Agenda/Qilin Ransomware – Detection and Mitigation

Qilin (also known as Agenda) ransomware has been used to attack healthcare and education organizations, primarily in Africa and Asia, since its discovery in August 2022. It is written in the Go programming language and has customization options, such as changing the filename extensions of encrypted files and terminating specific processes and services. The threat actors behind Qilin/Agenda practice double extortion, meaning they not only demand payment for a decryptor but also threaten to release stolen data if their demands are not met. Qilin ransomware has various encryption modes that can be configured by the operator, including skip-step, percent, and fast. SentinelOne protects against this ransomware and its different encryption modes.