Cybersecurity researchers have managed to infiltrate the Qilin ransomware group, shining light into the prosperous underworld of cybercrime. Qilin, also known as “Agenda,” is a ransomware-as-as-service (RaaS) group that was founded back in July of 2022 and has attacked twelve (12) organizations across the globe, with the primary victims being healthcare organizations, tech companies, education, and critical infrastructure. Additionally, the group explicitly abstains from attacking Russia and several of its neighbors. Within the inner workings of the Qilin RaaS group, actors of the organization recruit affiliates to identify targets of interest and stage attacks. Researchers found that “many Qilin ransomware attacks are customized for each victim to maximize their impact.” An administrative panel exists within the group to help oversee and coordinate operations. This panel helps divide sections of the operations into Targets, Blogs, Stuffers, News, Payments, and FAQs. Attacks carried out by Qilin typically begin with phishing emails containing malicious links to obtain access to victims’ servers. Once access is gained, sensitive data is exfiltrated and encrypted. Researchers uncovered that affiliates take home 80% of ransom payments and will receive 85% if the ransom payment is over $3 million. These numbers are significantly higher than alternative RaaS models, such as that of the REvil ransomware group where affiliates take home 60% to 70% of the ransom payment. While the researchers didn’t release how or when they gained access into Qilin’s RaaS program, their findings show an interesting look into how the gang functions and rewards affiliates for attacks. CTIX analysts will continue monitoring the evolving ransomware landscape.