Classification: TLP:CLEAR | Publication Date: 2026-09-22 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

QILIN Ransomware Gang: 14 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-09-18 and 2026-09-22, the QILIN ransomware operation published 14 new victim listings on its dark web leak site, representing a concentrated burst of activity across at least 8 countries and 7 sector classifications. Manufacturing, technology, and retail/e-commerce organizations feature most prominently. Every listing is an unverified claim by a criminal actor: nine of the fourteen postings were independently observed by a second leak-site crawler (meaning the gang demonstrably made the claim), while five appear on a single source only. No listing in this dataset confirms a breach occurred. Security teams in the affected sectors — particularly manufacturing and technology firms in North America, Europe, the Middle East, and Asia-Pacific — should treat this campaign tempo as a trigger to validate the detection and hardening controls detailed below, regardless of whether any specific claim proves accurate.

Sourcing & Verification

• Corroboration status: 9 of 14 listings were independently observed by a second leak-site crawler; 5 listings (Ascend Com, Ceres Tolvas, Futuro Forestal, Grupo Juste, Inland and Offshore Contractors) appear on a single source only and could not be independently re-observed.
• What a listing means: Inclusion on QILIN's leak site reflects the threat actor's claim of compromise. It is not confirmation of a breach. Multi-source corroboration confirms only that the gang published the claim — nothing more.
• Neither silence nor denial settles the question: A named organization may dispute a listing, and a denial is likewise not proof that the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Readers should treat all named organizations as alleged victims unless the organization itself or its regulator confirms otherwise.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — QILIN

Aliases: Qilin (the gang brands itself after the mythological creature), previously tracked under the Agenda name in earlier reporting.

Operating model: QILIN runs a Ransomware-as-a-Service (RaaS) program. The core group maintains the ransomware builder (notably Rust- and Go-based payloads with strong cross-platform coverage, including ESXi/Linux variants), the leak site, and negotiation infrastructure, while affiliates conduct intrusions. Affiliates historically receive a high revenue share (reportedly up to ~85%), which attracts experienced intrusion operators from other shuttered programs and makes TTPs heterogeneous across victims.

Ransom demands: Demands are calibrated to victim revenue and typically range from tens of thousands to several million USD, with double-extortion pressure applied via a countdown timer and staged data teasers on the leak site.

Known initial access methods:

• Spear phishing with malicious attachments/links leading to loaders and remote access tooling
• Exploitation of internet-facing edge services: VPN concentrators, firewalls, and remote access gateways
• Exposed or weakly authenticated RDP, including brute force and credential-stuffing against internet-facing RDP
• Valid accounts sourced from infostealer logs and access brokers

Double extortion: QILIN exfiltrates data before detonation and threatens publication. Encryption is frequently the last stage; the dwell window between initial access and detonation typically runs from days to a few weeks, with the most operationally detectable phase being data staging and exfiltration in the 24–72 hours before encryption.

Dwell time: Industry tracking of QILIN-class operations suggests a typical dwell time of roughly 3–14 days, with faster "smash-and-grab" intrusions possible when affiliates use purchased access.

Current Campaign Analysis

Sectors targeted (from observed listings)

Manufacturing leads with three listings (Textile City, IKEGAMI TSUSHINKI COMPANY LIMITED, Zorlu Holding), followed by Technology (Columbus Informatica, Telrad Networks, Ascend Com). Retail & E-Commerce (ShopDunk), Transportation (Touring Club Suisse), Agriculture and Food Production (Ceres Tolvas, Futuro Forestal), and Energy & Utilities (Inland and Offshore Contractors) each appear. This mix is consistent with QILIN's opportunistic, affiliate-driven model: sectors are selected by whoever sells the access, not by strategic direction from the core group.

Geographic concentration

The US and Canada anchor the set (The Fifty/50 — US; Textile City — CA), with significant Europe/Middle East presence (IT, IL, TR, DE, CH) and Asia-Pacific/Latin America spread (JP, TH, SG, AR, CL, MX, TT). This is a genuinely global campaign wave rather than a regionally focused one — defenders everywhere should read this as relevant.

Victim profile

The set skews toward mid-market organizations and regional enterprises: holdings companies, manufacturers, regional retailers, and specialized service firms — typically organizations with annual revenues in the tens of millions to low billions USD range. These are classic QILIN targets: large enough to pay, small enough to lack 24/7 SOC coverage. Zorlu Holding stands out as the largest named entity.

Posting frequency / escalation

14 listings over five days (2026-09-18 → 2026-09-22), with 4 posted on 2026-09-22 alone, indicates accelerating publication tempo — likely a backlog of completed intrusions being weaponized simultaneously for negotiation pressure, possibly combined with an affiliate influx. Watch for a second wave: leak-site batching often precedes a quieter collection period.

CVE exposure hypothesis (NOT attributed to any specific victim)

We have no evidence linking any CVE to any named organization above. However, QILIN-class affiliates are known to exploit exactly the edge-device and management-plane weaknesses currently on CISA's Known Exploited Vulnerabilities list, all confirmed for ransomware use:

• CVE-2026-59310 — VMware vCenter path traversal: hypervisor-level access enabling mass encryption of virtual estates, a hallmark of modern big-game ransomware.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: firewall management plane takeover.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): VPN edge compromise, a classic initial access vector.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply-chain foothold.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal: RMM abuse, heavily favored by affiliates for both access and persistence.

Organizations running any of these products internet-facing should patch/verify today — the exposure is sector-wide, independent of any specific claim.

Detection Engineering

---
title: QILIN Initial Access - RDP Brute Force Followed by Successful Logon
id: 9f3c1a2e-7b4d-4e5a-9c6f-1d2e3f4a5b6c
status: experimental
description: Detects a burst of failed RDP logons (Event 4625, logon type 10) followed by a successful network/RDP logon from the same source IP — a pattern consistent with QILIN affiliate brute-force initial access against exposed RDP.
author: Security Arsenal Threat Intelligence
date: 2026/09/22
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed and selection_success
timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1110
falsepositives:
  - Legitimate password spraying by internal scanners
  - User typos before successful logon (tune by source IP allowlist)
---
title: QILIN Lateral Movement - PsExec or WMI Remote Service Execution
id: 2a4b6c8d-1e3f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects remote service creation (Event 7045 / 4697) with service names or binary paths consistent with PsExec-style tooling, or WMI-spawned processes — lateral movement techniques commonly observed in QILIN intrusions before data staging.
author: Security Arsenal Threat Intelligence
date: 2026/09/22
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  selection_susp_service:
    CommandLine|contains:
      - 'ADMIN$'
      - 'IPC$'
      - '\\*\*\*.exe'
  condition: 1 of selection_*
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
falsepositives:
  - Legitimate admin tooling (SCCM, PDQ) — baseline by service name and source host
---
title: QILIN Pre-Encryption Staging - Shadow Copy Deletion and Mass Archive Exfil Indicators
id: 7d8e9f0a-2b3c-4d5e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects vssadmin/wmic/bcdedit shadow copy deletion, or creation of large compressed archives in unusual locations followed by outbound transfer tooling (rclone, FileZilla, curl) — the pre-detonation staging pattern used by QILIN operators.
author: Security Arsenal Threat Intelligence
date: 2026/09/22
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'recoveryenabled no'
  selection_exfil_tool:
    Image|endswith:
      - '\rclone.exe'
      - '\filezilla.exe'
      - '\curl.exe'
      - '\megasync.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\rar.exe'
    CommandLine|contains:
      - ' a -p'
      - '--transfers'
      - 'copy --'
  condition: selection_shadow or selection_exfil_tool
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1567
  - attack.t1560
falsepositives:
  - Backup software and legitimate admin archival — baseline by process path and parent

// QILIN pre-ransomware staging hunt: lateral movement -> archive creation -> exfil tooling
// Microsoft Sentinel / Defender XDR — run over last 7 days, alert on any host hitting 2+ stages
let Lookback = 7d;
let LateralMove =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("PSEXESVC", "\\ADMIN$", "wmic /node:", "wmic process call create",
        "net use \\", "copy \\", "Invoke-WMIMethod", "Enter-PSSession")
    | summarize LateralCount=count(), LateralCmds=make_set(ProcessCommandLine, 10) by DeviceName, bin(Timestamp, 1h);
let Staging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("rclone.exe","7z.exe","rar.exe","winrar.exe","curl.exe","megasync.exe","filezilla.exe")
       or ProcessCommandLine has_any ("vssadmin delete shadows","wmic shadowcopy delete","bcdedit","wbadmin delete catalog")
    | summarize StageCount=count(), StageCmds=make_set(ProcessCommandLine, 10) by DeviceName, bin(Timestamp, 1h);
let NetExfil =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any ("mega.nz","file.io","transfer.sh","gofile.io","anonfiles","tmpfiles.org")
       or (InitiatingProcessFileName in~ ("rclone.exe","curl.exe","filezilla.exe"))
    | summarize ExfilCount=count(), Destinations=make_set(RemoteUrl, 10) by DeviceName, bin(Timestamp, 1h);
LateralMove
| join kind=inner Staging on DeviceName
| join kind=leftouter NetExfil on DeviceName
| project DeviceName, LateralCount, LateralCmds, StageCount, StageCmds, ExfilCount, Destinations
| order by LateralCount desc

# QILIN Rapid Triage Script — run on servers/DCs during suspected intrusion (T-minus checks)
# Checks: exposed RDP, scheduled tasks added in last 7 days, shadow copy tampering, suspicious services
$ErrorActionPreference = 'SilentlyContinue'
$report = @{}

# 1. Is RDP exposed / recently brute-forced?
$report.RDP = [ordered]@{
    Enabled     = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
    Port        = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
    Failed4625  = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
                   Where-Object {$_.Message -match 'Logon Type:\s+10'} | Measure-Object).Count
}

# 2. Scheduled tasks created in last 7 days (persistence/staging)
$report.NewTasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author;
        Actions=($_.Actions | ForEach-Object {"$($_.Execute) $($_.Arguments)"}) -join '; ' }
} | Where-Object { $_.Actions -match 'powershell|cmd|wscript|rundll32|rclone|7z|curl|\\Users\\|\\Temp\\' }

# 3. Volume Shadow Copies — should exist; zero shadows on a server is a red flag
$report.ShadowCopies = (Get-CimInstance Win32_ShadowCopy | Measure-Object).Count

# 4. Recently created services (PsExec-style lateral movement artifacts)
$report.NewServices = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} |
    Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}}

# 5. Large archives modified in last 48h (staging indicator)
$report.RecentArchives = Get-ChildItem C:\,D:\ -Include *.zip,*.7z,*.rar,*.tar.gz -Recurse -Depth 3 |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-2) -and $_.Length -gt 100MB } |
    Select-Object FullName, Length, LastWriteTime

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\qilin_triage_$(Get-Date -Format yyyyMMdd_HHmm).json"
$report

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. Shadow copy / backup tampering: vssadmin, wmic shadowcopy, bcdedit, wbadmin events on any server — treat as pre-detonation.
2. Mass archive creation: multi-GB .7z/.rar/.zip files appearing in staging directories (often C:\Users\Public, C:\ProgramData, or a dedicated folder on a file server).
3. Exfil tooling: rclone, MEGASync, FileZilla, or heavy outbound TLS to consumer file-sharing domains.
4. Lateral movement bursts: PsExec service installs (Event 7045), WMI process creation, and RDP logon storms from a single source host.
5. EDR/AV tampering: attempts to disable, uninstall, or add exclusions to security tooling — often the final step before detonation.
6. Domain controller access: any non-admin workstation authenticating to DCs with admin-tier credentials.

Critical assets QILIN historically prioritizes for exfiltration

• File servers hosting finance, HR, and legal data
• Domain controllers / AD databases (credential theft enables full-estate encryption)
• Virtualization management planes (vCenter/ESXi) — encryption here maximizes blast radius
• Backup infrastructure (targeted for destruction to remove recovery leverage)
• Customer databases and IP repositories on application servers

Containment actions, ordered by urgency

1. Isolate affected hosts from the network (EDR isolate first — do not power off; preserve memory).
2. Disable compromised accounts and force enterprise-wide password resets, prioritizing privileged/DA accounts (reset twice to clear ticket material).
3. Block egress to known exfil destinations and the actor's infrastructure at the proxy/firewall.
4. Snapshot and preserve forensic evidence on key servers before any remediation.
5. Segment backup infrastructure and verify offline/immutable copies are intact and unreachable from production.
6. Hunt laterally using the KQL query above across the full estate — assume the patient-zero host is not the only foothold.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs listed above — vCenter (CVE-2026-59310), Cisco FMC (CVE-2026-20316), Check Point IKEv1 (CVE-2026-50751), Nx Console (CVE-2026-48027), ScreenConnect (CVE-2024-1708). Verify no internet-facing instance is unpatched.
• Kill exposed RDP: no RDP listening on the internet, anywhere. Enforce VPN + MFA for all remote administration; enable NLA and account lockout.
• Enforce phishing-resistant MFA (FIDO2/passkeys) on VPN, remote access, email, and all admin portals — QILIN affiliates live on stolen credentials.
• Deploy the Sigma rules and KQL hunt above and page on any critical-severity hit.
• Verify backups: confirm offline/immutable copies exist, test one restore, and ensure backup credentials are separate from AD.
• Block rclone/consumer sync binaries via application control (WDAC/AppLocker) for non-approved users.

Short-term (2 weeks)

• Tiered administration: separate admin workstations (PAWs) and tier-0 accounts; no DA logons from standard endpoints — eliminates the credential-theft path QILIN uses for estate-wide encryption.
• Network segmentation: isolate virtualization management, backup infrastructure, and OT/manufacturing segments from general user networks; manufacturing targets in this campaign should treat shop-floor segmentation as urgent.
• LSA protection + Credential Guard on all supported endpoints to blunt LSASS dumping.
• Egress filtering: default-deny outbound for servers; allowlist required destinations. Ransomware exfil dies without egress.
• Deception: deploy canary file shares and honey credentials to catch staging and credential access early.
• Disable Office macros from the internet (Mark-of-the-Web enforcement) org-wide to close the phishing-macro initial access path.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub