QILIN Ransomware: 16 New Victims in Global Surge — Education & Healthcare Sectors in Crosshairs as Critical CVEs Exploited

Threat Actor Profile — QILIN

QILIN (formerly known as Agenda) is a Ransomware-as-a-Service (RaaS) operation that has rapidly matured into a significant threat to enterprise environments. Known for developing a Rust-based encryptor capable of targeting both Windows and Linux systems, Qilin operates with an aggressive double-extortion model, exfiltrating sensitive data and threatening leaks on their .onion portal to pressure victims into payment.

• Ransom Demands: Variable, typically ranging from $500,000 to multi-million dollars depending on victim revenue and data sensitivity.
• Initial Access Vectors: Historically relies on phishing campaigns with macro-laced documents, but recent intelligence indicates a shift toward exploiting vulnerabilities in external-facing infrastructure, particularly Remote Monitoring and Management (RMM) tools (ConnectWise ScreenConnect) and VPN/security gateways (Check Point).
• Dwell Time: Qilin operators display a relatively short dwell time (average 3–7 days) once initial access is secured, often moving rapidly to lateral movement and data exfiltration prior to detonation.

Current Campaign Analysis

Based on live data pulled from the Qilin leak site on 2026-07-26, the gang has posted 16 victims within the last 100 postings, showing a distinct targeting pivot toward high-reliability sectors.

Targeted Sectors

The current campaign demonstrates a diversified but focused attack surface:

• Education: High hit rate (Kean University, Highline Community College, Universitatea de Vest „Vasile Goldiș”).
• Healthcare: Critical targeting (Stryker, Principle Diagnostics Laboratory).
• Manufacturing: Industrial targets (Guntert & Zimmerman, GURR Abdichtungstechnik, Machinerie P&W).
• Government & Defense: Notably, the Ejército Argentino (Argentine Army) was posted on 2026-07-24, indicating willingness to target state-sponsored entities.

Geographic Concentration

Qilin’s operation is globally dispersed. Recent victims span North America (US, MX), Europe (RO, DE, HR, GB), South America (AR), and Asia (CH, IN). There is no strict regional confinement, suggesting a "spray and pray" vulnerability scanning approach for initial access followed by manual targeting based on victim value.

CVEs and Initial Access

The victimology strongly correlates with the actively exploited vulnerabilities observed in the wild:

• CVE-2024-1708 (ConnectWise ScreenConnect): The high number of Professional Services and Education victims suggests exploitation of unpatched RMM tools, a staple for Qilin gaining administrative access.
• CVE-2026-50751 (Check Point Security Gateway): The compromise of Ejército Argentino (Gov/Defense) and several manufacturing entities aligns with the exploitation of this critical VPN flaw to bypass perimeter defenses.
• CVE-2023-21529 (Microsoft Exchange): Likely used for initial access in sectors where Exchange servers remain internet-facing.

Detection Engineering

The following detection rules and hunt queries are designed to identify Qilin-specific behaviors, focusing on the exploitation of remote access tools and data staging prior to encryption.

SIGMA Rules

title: Potential Qilin Ransomware Activity - ScreenConnect Web Shell Creation
id: 4e8f3d12-1a9b-4c2a-9d0f-3b5e6c7d8a9f
description: Detects the creation of unexpected files in the ScreenConnect web directory, a common indicator of CVE-2024-1708 exploitation used by Qilin for initial access.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: 
            - '\\App_Data\\'
            - '\\Program Files\\ScreenConnect\\'
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
    filter:
        Image|contains:
            - 'ScreenConnect.Service'
            - 'ScreenConnect.Client'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative updates via ScreenConnect
level: critical
---
title: Qilin Pre-Encryption Shadow Copy Deletion
id: 5f9g4e23-2b0c-5d3b-0e1g-4c6f7d8e9a0b
description: Detects commands used by Qilin to delete Volume Shadow Copies using vssadmin or wbadmin prior to encryption.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
logsource:
    product: windows
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wbadmin:
        Image|endswith: '\\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection*
falsepositives:
    - System administrator maintenance (rare)
level: high
---
title: Suspicious Rclone Execution for Data Exfiltration
id: 6a0h5f34-3c1d-6e4c-1f2h-5d7g8e9f0b1c
description: Detects the execution of rclone, a tool frequently used by Qilin for data exfiltration to cloud storage before encryption.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\\rclone.exe'
        CommandLine|contains:
            - 'sync'
            - 'copy'
            - 'config create'
    condition: selection
falsepositives:
    - Legitimate backup usage by IT staff
level: medium

KQL (Microsoft Sentinel)

// Hunt for lateral movement and staging indicators associated with Qilin
// Looks for unexpected use of RMM tools, PSExec, and high-volume data movement
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where 
    // Check for exploitation tools or lateral movement
    FileName in~ ('psexec.exe', 'psexec64.exe', 'rclone.exe', 'powershell.exe') or
    InitiatingProcessFileName has 'ScreenConnect' or InitiatingProcessFileName has 'AnyDesk' or 
    InitiatingProcessFileName has 'TeamViewer'
| where 
    // Filter for suspicious command line arguments typical of Qilin
    CommandLine has 'Invoke-Expression' or 
    CommandLine has 'DownloadString' or 
    CommandLine has 'enc' or 
    CommandLine has 'sync' or
    CommandLine has 'delete shadows'
| summarize count(), ArgList=make_set(CommandLine) by DeviceName, FileName, AccountName
| where count_ > 3 // High frequency of suspicious commands

PowerShell (Rapid Response)

# Qilin Incident Response Script
# Checks for recent scheduled tasks (persistence) and VSS health

Write-Host "[+] Checking for suspicious scheduled tasks created in the last 7 days..." -ForegroundColor Cyan
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -ge $DateCutoff} | ForEach-Object {
    $TaskInfo = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
    Write-Host "ALERT: Recent Task Found - $($_.TaskName) ($($_.TaskPath)) Last Run: $($TaskInfo.LastRunTime)" -ForegroundColor Red
    Get-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath | Select-Object -ExpandProperty Actions
}

Write-Host "[+] Checking Volume Shadow Copy Storage status..." -ForegroundColor Cyan
try {
    $VSS = vssadmin list shadows
    if ($VSS -match "No shadow copies found") {
        Write-Host "WARNING: No Volume Shadow Copies found. Possible deletion event." -ForegroundColor Red
    } else {
        Write-Host "Shadow copies present." -ForegroundColor Green
    }
} catch {
    Write-Host "Error checking VSS: $_" -ForegroundColor Yellow
}

Incident Response Priorities

1. T-minus Detection Checklist:

   • VPN Logs: Immediately audit logs for Check Point Security Gateway (CVE-2026-50751) anomalies on 2026-07-24 through 2026-07-26. Look for successful IKEv1 handshakes from unusual geolocations.
   • RMM Audits: ScreenConnect (ConnectWise) logs are paramount. Search for path traversal attempts or unauthorized SessionConnect activities.
   • Exchange IIS Logs: Hunt for POST requests to /owa/auth.owa or similar endpoints utilizing Cmdlet bindings (CVE-2023-21529).

2. Critical Assets for Exfiltration:

   • Education: Student PII, financial aid records, research databases (e.g., Kean University, Highline CC).
   • Healthcare: Patient PHI, lab results, insurance data (e.g., Stryker, Principle Diagnostics).
   • Gov/Defense: Classified personnel data, logistics, operational communications (e.g., Ejército Argentino).

3. Containment Actions (Order by Urgency):

   • Isolate: Disconnect internet-facing VPN concentrators and RMM jump servers immediately if compromise is suspected.
   • Revoke: Reset credentials for all accounts that have logged into ScreenConnect or Exchange via web interfaces in the last 30 days.
   • Block: Network segmentation to prevent SMB/WMI lateral movement from admin workstations to critical servers.

Hardening Recommendations

• Immediate (24h):

  • Patch: Apply patches for CVE-2024-1708 (ScreenConnect) and CVE-2026-50751 (Check Point) globally.
  • MFA: Enforce hardware token MFA (FIDO2) for all VPN and remote access solutions; disable SMS/App TOTP if possible as it is susceptible to MFA fatigue attacks used by Qilin.
  • Disable: Turn off unused VPN protocols (IKEv1) and restrict RDP access at the firewall level.

• Short-term (2 weeks):

  • Architecture: Implement a "Zero Trust" access model for RMM tools, ensuring technicians must authenticate via SSO and justify access requests.
  • Monitoring: Deploy specific detection rules for webshell creation on internet-facing servers (IIS/Apache) and monitor for rclone execution on endpoints.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub