QILIN Ransomware: Aggressive Multi-Vector Campaign Targeting US & Europe

Aliases: Agenda, Qilin Operation Model: Ransomware-as-a-Service (RaaS). Qilin operates an affiliate program where core developers maintain the Rust-based encryption payload while independent affiliates handle initial access and lateral movement. Ransom Demands: Variable, typically ranging from $500,000 to multi-million dollars depending on victim revenue, often negotiable. Initial Access Methods: Historically relies on compromised credentials, phishing leading to initial foothold, and exploitation of public-facing applications. Recent activity strongly suggests a pivot toward exploiting remote management and perimeter security vulnerabilities. Double Extortion: Strict adherence to double extortion. Exfiltrated data is previewed on the .onion site to pressure victims; failure to pay results in full data publication. Dwell Time: Qilin affiliates typically maintain persistence for 3 to 10 days before detonating encryption, utilizing this window for extensive data staging and exfiltration.

Current Campaign Analysis

Sectors Targeted: The latest batch of 15 victims indicates a diversified but focused strategy:

Professional Services: 3 victims (e.g., Community Management Associates, Excel Consultores).
Technology: 3 victims (e.g., Audio Precision, Byonyks).
Agriculture & Food Production: 2 victims (e.g., The Dcoop, Db Tarimsal Enerji).
Healthcare, Financial Services, Manufacturing, Transportation: 1 victim each.

Geographic Concentration:

Americas: Dominated by the US (7 victims), followed by Mexico, Chile, and Ecuador.
Europe: Spain, Belgium, and Great Britain.
Other: Turkey.

Victim Profile: Targets range from mid-market entities (e.g., local dental chains, specialized manufacturing) to larger international cooperatives (e.g., Dcoop). The heavy targeting of Technology and Professional Services suggests affiliates are leveraging supply chain relationships or remote access software common in these sectors.

Observed Posting Frequency: Qilin maintained a high cadence, with 13 of the 15 victims posted between July 30 and July 31, 2026. This "burst" posting often correlates with a coordinated push by affiliates before a holiday weekend or a major operational shift.

CVE Connection & Initial Access Vectors: The victimology overlaps significantly with the CISA KEV list provided. We assess with high confidence that Qilin affiliates are actively exploiting:

CVE-2024-1708 (ConnectWise ScreenConnect): A critical path traversal vulnerability allowing remote code execution. This is a likely vector for the Technology and Professional Services victims who rely heavily on remote monitoring and management (RMM) tools.
CVE-2026-50751 (Check Point Security Gateway) & CVE-2026-20131 (Cisco Secure Firewall): The compromise of perimeter appliances facilitates initial network access for victims across all geos, particularly those with robust VPN infrastructures.

Detection Engineering

The following detection logic targets Qilin's known TTPs, specifically focusing on the exploitation of remote access tools (ScreenConnect), perimeter firewall anomalies (Check Point), and common lateral movement patterns (Cobalt Strike).

YAML

title: Potential Qilin Affiliated ScreenConnect Exploitation (CVE-2024-1708)
id: 9b1c3b6e-7a4f-4c9d-8b2a-1f3e5d7a9c0e
description: Detects potential exploitation of ConnectWise ScreenConnect authentication bypass and path traversal vulnerabilities used by Qilin affiliates for initial access.
status: experimental
date: 2026/08/01
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
product: screenconnect
detection:
    selection:
        cs-uri-query|contains:
            - '/WebService.asmx/'
            - 'Host='
            - 'SessionId='
    selection_exploit:
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
    condition: selection and selection_exploit
falsepositives:
    - Legitimate administrative misconfigurations (rare)
level: critical
---
title: Suspicious Check Point VPN IKEv1 Activity (Qilin Initial Access)
id: a8d2e4f1-6b3c-4a8e-9d1f-2e4b6c8a0d2e
description: Identifies anomalies in Check Point Security Gateway logs indicative of CVE-2026-50751 exploitation or brute forcing, often used by Qilin for perimeter breach.
status: experimental
date: 2026/08/01
author: Security Arsenal Research
logsource:
    product: checkpoint
    service: vpn
detection:
    selection_ikev1:
        product|contains: 'VPN'
        proto|contains: 'IKE'
        ike_version: '1'
    selection_failure:
        action: 'decrypt' or 'key_install'
        result: 'failure'
    selection_volume:
        timeframe: 1m
        count|gt: 10
    condition: selection_ikev1 and selection_failure | count() by src_ip > selection_volume
falsepositives:
    - Legacy VPN clients attempting reconnection
    - Misconfigured VPN gateways
level: high
---
title: Cobalt Strike Service Installation Lateral Movement
id: c3f4a5b6-8d7e-4f0a-9b2c-3d4e5f6a7b8c
description: Detects the installation of services with suspicious names commonly used by Cobalt Strike beacons, a preferred tool for Qilin lateral movement.
status: experimental
date: 2026/08/01
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains:
            - 'powershell.exe -nop -w hidden -c'
            - 'C:\\Windows\\Temp\\'
        ServiceName|contains:
            - 'AdminUpdate'
            - 'MsUpdate'
            - 'JavaUpdate'
    condition: selection
falsepositives:
    - Legitimate software updates (verify path and signature)
level: high


kql
// KQL Hunt for Qilin Pre-Encryption Staging
// Hunts for high volume data transfers to non-corporate IPs and common staging tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has_any ("powershell.exe", "cmd.exe", "rclone.exe", "winscp.exe")
| where ProcessCommandLine has_any ("7z", "winrar", "compress", "archive")
| join kind=inner (DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort in (443, 80, 21) and InitiatingProcessFileName has_any ("powershell.exe", "rclone.exe")
    | summarize SentBytes=sum(SentBytes), RemoteIP=any(RemoteIP) by DeviceId, InitiatingProcessCommandLine
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, SentBytes
| where SentBytes > 100000000 // Greater than 100MB
| order by SentBytes desc


powershell
# Rapid Response Script: Qilin Persistence Check
# Identifies suspicious scheduled tasks and services created in the last 7 days
$DateCutoff = (Get-Date).AddDays(-7)

Write-Host "[+] Checking for recently created Scheduled Tasks (Persistence)..."
Get-ScheduledTask | Where-Object {$_.Date -ge $DateCutoff} | ForEach-Object {
    $TaskInfo = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
    Write-Host "Task: $($_.TaskName) - Last Run: $($TaskInfo.LastRunTime) - Action: $($_.Actions.Execute)"
}

Write-Host "[+] Checking for Services with suspicious paths..."
Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -match "\\Temp\\" -or 
    $_.PathName -match "powershell.*-enc" -or
    $_.State -eq "Running" -and $_.StartMode -eq "Auto" -and $_.InstallDate -gt $DateCutoff
} | Select-Object Name, State, PathName, InstallDate | Format-Table -AutoSize

Write-Host "[+] Checking for Shadow Copy deletions (VssAdmin)..."
Get-WinEvent -LogName Application -MaxEvents 1000 -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match "vssadmin" -and $_.Message -match "delete shadows"
} | Select-Object TimeCreated, Message | Format-List

Incident Response Priorities

Based on Qilin's observed playbook, IR teams should execute the following immediately upon suspicion of compromise:

T-minus Detection Checklist:
- VPN/Perimeter Logs: Query Check Point and Cisco logs for spikes in IKEv1 failures or authentication anomalies associated with CVE-2026-50751 and CVE-2026-20131.
- ScreenConnect Audit: Immediately audit ConnectWise ScreenConnect logs for path traversal attempts (CVE-2024-1708) on the /WebService.asmx endpoint.
- PowerShell Auditing: Hunt for encoded PowerShell commands spawned by cmd.exe or svchost.exe.
Critical Assets Prioritized for Exfiltration:
- Qilin aggressively targets Pii/PHI (Healthcare), Intellectual Property (Technology), and Financial Data (Professional Services). Secure backups for these specific data classes first.
Containment Actions (Urgency Order):
- Isolate: Disconnect infected hosts from the network; do not shutdown immediately if memory forensics are required to capture Cobalt Strike keys.
- Revoke Credentials: Force reset of all privileged credentials (Domain Admins) used on compromised VPN or RMM tools.
- Block Network: Block outbound C2 traffic to known Qilin infrastructure and non-standard ports (e.g., high UDP ports for Cobalt Strike).

Hardening Recommendations

Immediate (24h):

Patch CISA KEV: Prioritize patching CVE-2024-1708 (ScreenConnect), CVE-2026-50751 (Check Point), and CVE-2026-20131 (Cisco FMC). If patching is not possible, disable the affected services (e.g., block internet access to ScreenConnect web interfaces).
MFA Enforcement: Ensure all VPN access and remote management tools enforce phishing-resistant MFA (FIDO2).

Short-term (2 weeks):

Network Segmentation: Restrict lateral movement by enforcing strict segmentation policies, preventing workstations from communicating directly with server segments.
Egress Filtering: Implement strict egress filtering to block unauthorized data exfiltration tools (e.g., rclone, WinSCP) and non-standard DNS/HTTP traffic.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub