QILIN Ransomware: 18 New Victims Posted — Critical Vulnerability Exploitation (SmarterMail & Cisco FMC)

title: Potential SmarterMail Exploitation Activity
description: Detects potential web shell upload or exploitation attempts related to SmarterMail vulnerabilities (CVE-2025-52691, CVE-2026-23760).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/25
tags:
  - attack.initial_access
  - attack.web_shell
  - cve.2025.52691
logsource:
  product: windows
  service: iis
detection:
  selection:
    cs-uri-stem|contains:
      - '/Services/Mail.asmx'
      - '/LiveChat/UploadFile.ashx'
    cs-method: 'POST'
  filter Legit:
    cs-user-agent|contains: 'Mozilla'  # Basic filter, adjust to environment
  condition: selection and not filter Legit
falsepositives:
  - Legitimate administrative access via web interface
level: high

---

title: Suspicious Process Execution on Cisco FMC (Linux)
description: Detects suspicious shell activity spawned by the Java/Tomcat service hosting Cisco FMC, indicative of deserialization exploits (CVE-2026-20131).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/25
tags:
  - attack.execution
  - cve.2026.20131
  - attack.t1059.004
logsource:
  product: linux
detection:
  selection_parent:
    pparent_name|contains: 'java'  # FMC runs on Java/Tomcat
  selection_child:
    pname|contains:
      - 'sh'
      - 'bash'
      - 'nc'
      - 'curl'
      - 'wget'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative troubleshooting
level: critical

---

title: Qilin Ransomware Pre-Encryption Shadow Copy Deletion
description: Detects commands often used by Qilin affiliates to delete Volume Shadow Copies via PowerShell or CMD before encryption.
references:
  - Internal Threat Intel
author: Security Arsenal Research
date: 2026/05/25
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: windows
  category: process_creation
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_powershell:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - '.Delete()'
  condition: 1 of selection_
falsepositives:
  - System administrator maintenance (rare)
level: high

// Hunt for SmarterMail exploitation indicators and lateral movement
let SmarterMailServers = DeviceNetworkEvents
| where RemoteUrl contains "SmarterMail" or InitiatingProcessFileName == "MailService.exe";
union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(7d)
| where 
    // Indicators of Web Shell activity or unusual access
    (FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") and InitiatingProcessFileName in~ ("w3wp.exe", "java.exe"))
    or 
    // Data Staging - Large file moves to non-standard paths
    (FolderPath endswith ".zip" and FileSize > 10000000 and ProcessVersionInfoOriginalFileName !in~ ("WINZIP.EXE", "7zFM.exe"))
    or
    // Lateral Movement - RDP/SMB anomalous usage
    (RemotePort in (3389, 445) and InitiatingProcessAccountName != "SYSTEM" and InitiatingProcessAccountName !contains "$")
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessAccountName, FolderPath, RemoteIP, RemotePort
| order by Timestamp desc

# QILIN Response Script: Scheduled Task Enumeration & VSS Health Check
# Requires Admin Privileges

Write-Host "[+] Checking Volume Shadow Copy Storage Health..." -ForegroundColor Cyan
$vss = Get-WmiObject -Class Win32_ShadowCopy | Measure-Object
if ($vss.Count -eq 0) {
    Write-Host "[!] CRITICAL: No Volume Shadow Copies found. Possible deletion attempt." -ForegroundColor Red
} else {
    Write-Host "[+] Found $($vss.Count) Shadow Copy snapshots." -ForegroundColor Green
}

Write-Host "\n[+] Hunting for Scheduled Tasks created in the last 7 days (Persistence)..." -ForegroundColor Cyan
$dateCutoff = (Get-Date).AddDays(-7)
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $dateCutoff}

if ($suspiciousTasks) {
    Write-Host "[!] WARNING: Found $($suspiciousTasks.Count) tasks created recently:" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious recent scheduled tasks detected." -ForegroundColor Green
}

Write-Host "\n[+] Checking for common Qilin/Staging directories..." -ForegroundColor Cyan
$paths = @("C:\Windows\Temp\", "C:\ProgramData\", "C:\Perflogs")
$extensions = @("*.exe", "*.dll", "*.bat")
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Include $extensions -Recurse -ErrorAction SilentlyContinue | 
        Where-Object {$_.LastWriteTime -gt $dateCutoff} | 
        Select-Object FullName, LastWriteTime | Format-Table
    }
}


---