QILIN Ransomware Gang: 11 New Victims in 72 Hours — Manufacturing Surge, Edge-Device CVE Exploitation & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-08-06 | Source: ransomware.live monitoring of QILIN .onion leak infrastructure | Analyst: Security Arsenal — From The Dark Side

Executive Summary

Between 2026-08-04 and 2026-08-06, the QILIN ransomware operation posted 11 new victims to its dark web leak site — an aggressive tempo even by this group's established standards. The victim set spans 7 countries (US, TR, FR, PL, AT, IE, DE) and shows a pronounced concentration in manufacturing (4 of 11 victims) alongside energy, financial services, professional services, and hospitality. The simultaneous disclosure of a US financial institution (J&T Bank and Trust) and a US energy-sector firm (AmSpec) on the same day indicates QILIN affiliates are not sector-gating their intrusions — they are monetizing any foothold they can obtain.

Organizations running Check Point gateways, Cisco FMC, ConnectWise ScreenConnect, or unpatched Exchange servers should treat this briefing as an active-threat notification, not background reading.

Threat Actor Profile — QILIN

Current Campaign Analysis

Sector Targeting (last 11 postings)

• Manufacturing — 4 victims (Mera Metal/PL, STADLER Sensorik/AT, Galvin Brothers/IE, RUPP Spritzguss/DE): A deliberate European industrial cluster. CNC, injection-molding, and precision-sensor firms hold IP-heavy design files and run OT-adjacent networks with historically weak segmentation — high leverage for extortion.
• Professional Services — 2 (Akuur Law Firm/TR, ALIZE/FR): Law firms are aggregation points for client-confidential data; QILIN has repeatedly monetized legal-sector breaches for the secondary embarrassment value.
• Energy & Utilities — 1 (AmSpec/US): Inspection/testing services to energy infrastructure. Sector adjacency to critical infrastructure raises regulatory fallout (NERC CIP adjacency, state breach laws).
• Financial Services — 1 (J&T Bank and Trust/US): Banking-sector posting signals affiliate willingness to take on heavily regulated targets with high ransom tolerance.
• Hospitality — 1 (Stade Francais/FR); Other — 1 (WD Masonry/US); Unclassified — 1 (Jakle & Alexander/US).

Geographic Concentration

The US remains the anchor market (4 of 11), but Europe accounts for 6 of 11 postings (TR, FR×2, PL, AT, IE, DE) — a noticeable westward-European manufacturing arc consistent with affiliates exploiting perimeter devices at mid-market industrial firms that lack 24×7 SOC coverage.

Victim Profile

Predominantly SMB-to-mid-market organizations (est. $10M–$500M revenue) — large enough to pay, small enough to lack mature detection. This matches QILIN's affiliate economics: fast intrusions against soft perimeters, moderate ransoms, high volume.

Posting Frequency / Escalation

4 postings on 08-06 alone, following 3 on 08-05 and 3 on 08-04 (with an additional unlisted posting rounding the count to 11 in-window). A sustained 3–4/day cadence indicates either multiple concurrent affiliates or a backlog flush — both historically precede a broader campaign wave.

CVE Correlation — Probable Initial Access Vectors

The CISA KEV entries confirmed for ransomware use align tightly with QILIN's known access patterns:

• CVE-2026-50751 (Check Point Security Gateway, improper auth in IKEv1) — the single most consistent edge-access vector this season. If you run Check Point with IKEv1 VPN enabled and have not patched since 2026-06-08, assume hostile reconnaissance has already occurred.
• CVE-2026-20131 (Cisco FMC / SCC deserialization) — firewall management plane compromise gives attackers both persistence and visibility into your detection stack.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — QILIN affiliates have repeatedly repurposed MSP/RMM tooling for both access and post-compromise lateral movement.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-tooling supply chain vector; consistent with QILIN's interest in build-pipeline access yielding valid credentials and signing keys.
• CVE-2023-21529 (Exchange deserialization) — legacy but still effective against unpatched on-prem Exchange, providing authenticated RCE and mailbox-based phishing infrastructure.

Assessment: The campaign is opportunistic-perimeter-driven, not zero-day-driven. Every one of these CVEs has a vendor fix. Patching cadence — not attacker sophistication — is the differentiator between the 11 posted victims and everyone else.

Detection Engineering

Sigma Rules

---
title: QILIN Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 7c9a1f2e-4b6d-4e8a-9f3c-2d5a8b1e6f01
status: production
description: Detects shadow copy deletion and boot recovery tampering consistent with QILIN pre-encryption staging. QILIN affiliates routinely execute vssadmin/wmic/bcdedit before detonating the Rust-based encryptor.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd_vss:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_cmd_bcd:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_img and 1 of selection_cmd_*
falsepositives:
  - Backup software (Veeam, Commvault) legitimate shadow operations
  - IT admin maintenance windows
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: QILIN Initial Access - Suspicious Process Spawning from VPN Edge Device Sessions
id: 8d1b3c4f-5a7e-4f9b-8c2d-3e6b9d2f7a12
status: production
description: Identifies interactive sessions and process execution originating from VPN concentrator subnets shortly after authentication, a hallmark of QILIN affiliate access following Check Point IKEv1 (CVE-2026-50751) or similar edge exploitation.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'
  selection_suspect_child:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\anydesk.exe'
      - '\screenconnect.clientservice.exe'
      - '\rclone.exe'
      - '\sharphound.exe'
  selection_cli:
    CommandLine|contains:
      - 'bloodhound'
      - '-c zip'
      - 'copy --transfers'
      - 'accepteula'
  condition: selection_parent and selection_suspect_child and selection_cli
falsepositives:
  - Legitimate RMM deployments — baseline your sanctioned tooling and exclude by hash/path
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1567.002
---
title: QILIN Exfiltration - RClone or MEGA Sync Execution on Servers
id: 9e2c4d5a-6b8f-4a1c-9d3e-4f7c1e3a8b23
status: production
description: Detects execution of RClone/MEGAcmd on server-class systems. QILIN stages victim data with RClone to cloud storage before encryption; execution on a server with no sanctioned backup role is a T-minus indicator.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\mega-cmd-server.exe'
  selection_flags:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
  condition: selection_img and selection_flags
falsepositives:
  - Sanctioned cloud backup jobs — whitelist known service accounts and paths
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
date: 2026/08/06

KQL — Microsoft Sentinel Hunt: Pre-Ransomware Staging & Lateral Movement

// QILIN T-minus hunt: shadow deletion + remote exec + staging tools within 6h window
let Lookback = 7d;
let Window = 6h;
let ShadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
        or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
    | project ShadowTime=TimeGenerated, DeviceName, AccountName, ShadowCmd=ProcessCommandLine;
let RemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("psexec.exe","psexesvc.exe","wmic.exe")
        or ProcessCommandLine has_any ("\\ADMIN$","\\IPC$","/node:")
    | project RemoteTime=TimeGenerated, DeviceName, AccountName, RemoteCmd=ProcessCommandLine, InitiatingProcessFileName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("rclone.exe","megacmd.exe","7z.exe","rar.exe")
        or ProcessCommandLine has_any ("--transfers","mega.nz","a ", "v -r")
    | project StageTime=TimeGenerated, DeviceName, AccountName, StageCmd=ProcessCommandLine, FolderPath;
ShadowDelete
| join kind=inner RemoteExec on DeviceName
| where RemoteTime between (ShadowTime .. ShadowTime + Window) or ShadowTime between (RemoteTime .. RemoteTime + Window)
| join kind=leftouter Staging on DeviceName
| where isnull(StageTime) or StageTime between (RemoteTime - Window .. RemoteTime + Window)
| extend KillChainScore = 3 + iif(isnotnull(StageTime), 2, 0)
| project DeviceName, AccountName, ShadowTime, ShadowCmd, RemoteTime, RemoteCmd, StageTime, StageCmd, KillChainScore
| order by KillChainScore desc, ShadowTime desc;

Analyst note: Any host scoring 5 (shadow deletion + remote exec + staging tool in-window) is a T-minus event — assume encryption is hours away and move directly to containment.

PowerShell — Rapid Triage: 7-Day Persistence & Shadow Copy Audit

# QILIN Rapid Triage — run on suspect hosts or via your EDR's live response
# Checks: scheduled tasks (7d), new services (7d), shadow copies, exposed RDP
$cutoff = (Get-Date).AddDays(-7)
$report = [ordered]@{}

# 1) Scheduled tasks created/modified in last 7 days
$report['NewScheduledTasks'] = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TaskName   = $_.TaskName
        TaskPath   = $_.TaskPath
        Author     = $_.Author
        LastRun    = $info.LastRunTime
        Action     = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    }
} | Where-Object { $_.TaskPath -notlike '\Microsoft*' }

# 2) Services installed in last 7 days (common PsExec/AnyDesk persistence)
$report['NewServices'] = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    ForEach-Object { [PSCustomObject]@{ Time=$_.TimeCreated; Service=$_.Properties[0].Value; Binary=$_.Properties[1].Value } }

# 3) Volume Shadow Copies — QILIN deletes these pre-encryption; empty = red flag
$report['ShadowCopies'] = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue |
    Select-Object @{n='Created';e={$_.InstallDate}}, VolumeName, DeviceObject

# 4) RDP exposure check
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$report['RDPStatus'] = [PSCustomObject]@{
    RdpEnabled = ($rdp.fDenyTSConnections -eq 0)
    NlaEnforced = ($nla.UserAuthentication -eq 1)
    ListeningPort = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
}

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\qilin_triage_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage complete. Empty ShadowCopies + recent 7045 events + RDP without NLA = escalate to IR immediately." -ForegroundColor Yellow

Incident Response Priorities — QILIN Playbook

T-Minus Detection Checklist (BEFORE encryption fires)

• vssadmin delete shadows / bcdedit recoveryenabled no execution on any server — single highest-fidelity pre-detonation signal
• RClone/MEGAcmd processes or outbound transfers >5GB to consumer cloud storage
• New AnyDesk/ScreenConnect installations not matching your sanctioned RMM baseline
• BloodHound/SharpHound collection artifacts (*.zip in user temp dirs, LDAP query spikes from non-DC hosts)
• PsExec service creation (Event ID 7045 with PSEXESVC) across multiple hosts from one account
• Safe-mode boot configuration changes (QILIN's encryptor supports safe-mode execution to evade EDR)
• Unusual Kerberos TGS requests for service accounts from workstation subnets

Assets QILIN Historically Prioritizes for Exfiltration

1. File servers & NAS — contracts, financials, HR records (the extortion payload)
2. Backup infrastructure (Veeam/Commvault) — targeted for destruction first to force payment
3. Domain controllers — NTDS.dit theft for persistent credential access
4. Legal/finance mailboxes — especially at professional-services victims (see Akuur Law Firm posting)
5. CAD/design repositories at manufacturing victims — IP theft amplifies ransom pressure

Containment Actions — Ordered by Urgency

1. Isolate at the network layer, not the OS layer — VLAN-quarantine affected segments; do NOT power off (memory-resident encryptors destroy evidence and may auto-detonate on reboot)
2. Disable the suspected compromised accounts — force-reset all accounts with interactive logons in the dwell window
3. Block egress to consumer cloud storage (MEGA, Dropbox, GDrive personal) at the proxy/firewall to choke active exfiltration
4. Snapshot and isolate backups immediately — verify at least one offline/immutable copy predates the earliest IOC timestamp
5. Preserve VPN/firewall logs before rollover — edge-device logs (Check Point, Cisco FMC) are your initial-access ground truth and rotate fast
6. Engage IR retainer and legal counsel before any negotiation contact; check OFAC/sanctions exposure on payment decisions

Hardening Recommendations

Immediate (24 hours)

• Patch the perimeter stack: Check Point Security Gateway (CVE-2026-50751), Cisco FMC/SCC (CVE-2026-20131), ConnectWise ScreenConnect (CVE-2024-1708), Exchange (CVE-2023-21529). If you cannot patch, take the service offline — these are confirmed ransomware-exploited.
• Audit developer workstations for Nx Console versions affected by CVE-2026-48027; rotate any credentials present on compromised build machines.
• Enforce phishing-resistant MFA on all VPN, RDP, and remote-access tooling; disable IKEv1 Aggressive Mode on Check Point gateways.
• Block RClone/MEGAcmd/7-Zip execution on servers via AppLocker/WDAC unless explicitly sanctioned.
• Deploy the Sigma rules and KQL query above; run the PowerShell triage script against all internet-adjacent servers and any host with unusual logon patterns in the last 14 days.
• Verify shadow copies exist on critical servers and that backup infrastructure is segmented with separate credentials.

Short-Term (2 weeks)

• Segment manufacturing/OT-adjacent networks from corporate IT — the European industrial cluster in this campaign (Mera Metal, STADLER, Galvin Brothers, RUPP) is the demographic least likely to have done this.
• Deploy immutable/offline backups (object-lock or air-gapped) with quarterly restoration tests; QILIN explicitly hunts backup infrastructure.
• Baseline and alert on RMM tooling: maintain an allowlist of sanctioned remote-access binaries; alert on everything else. ScreenConnect/AnyDesk abuse is a QILIN signature.
• EDR in block mode on all servers, with tamper protection and safe-mode coverage validated.
• Deception layer: honey credentials and canary file shares on high-value servers provide near-zero-false-positive early warning of staging activity.
• Tabletop the T-minus checklist with your SOC — the gap between "shadow copies deleted" and "encryptor detonated" can be under 6 hours; rehearse the muscle memory now.

Security Arsenal continuously monitors ransomware leak infrastructure via ransomware.live. Victim postings represent adversary claims; inclusion does not confirm breach details. If your organization appears in threat actor leak data, engage incident response immediately.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub