QILIN Ransomware Gang: 14 New Leak-Site Listings — Sector Targeting Analysis, Detection Rules & Response Playbook

Classification: TLP:CLEAR | Publication Date: 2026-11-01 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-29 and 2026-11-01, the QILIN ransomware operation published 14 new victim listings on its dark web leak site. The postings span eight sectors — with manufacturing, technology, and transportation most heavily represented — and eight countries, including the United States, Germany, Mexico, Taiwan, and the Philippines. Notable listings include a U.S. municipal government (City of Columbia, SC), transportation infrastructure operators (Palletline, Light Rail Manila), and industrial manufacturers (Proterial, TRAUCO AG, Honghwa International).

Every listing below is a claim made by a criminal organization on its own extortion infrastructure. Independent crawler corroboration confirms the postings exist; it does not confirm any breach occurred. This briefing translates QILIN's observed claim activity into sector-level exposure analysis and detection engineering content so defenders can hunt for this actor's known tradecraft regardless of whether any individual claim proves accurate.

Sourcing & Verification

• Corroboration breakdown: 14 of 14 listings in this dataset were independently observed by a second leak-site crawler; 0 appear on a single source only. Multi-source observation confirms the gang published the claim — nothing more.
• What inclusion means: A listing reflects the threat actor's accusation. It is not confirmation of a breach, and no tier in our data supports asserting that any named organization was compromised.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question; only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — QILIN

Aliases: Qilin, Agenda (the group's ransomware was originally observed under the Agenda name in mid-2022 before rebranding).

Operating model: Ransomware-as-a-Service (RaaS). QILIN recruits affiliates through underground forums, providing the encryptor (written in Rust and Go variants), negotiation infrastructure, and the leak site, in exchange for a revenue share typically reported in the 15–20% range. The Rust-based encryptor is notable for its cross-platform capability, with builds targeting Windows, Linux, and VMware ESXi — consistent with the group's focus on virtualized enterprise environments.

Ransom demands: Vary by victim revenue, with demands against mid-market and enterprise victims commonly reported in the low-to-mid seven figures (USD), and a hard-ball negotiation posture that includes countdown timers and incremental data leaks.

Initial access methods (historically observed across QILIN intrusions):

• Phishing with malicious attachments or links leading to credential harvesting
• Exploitation of exposed remote access services — VPN appliances and RDP
• Valid accounts acquired from access brokers or credential dumps
• In some campaigns, exploitation of unpatched internet-facing applications

Extortion approach: Classic double extortion — data theft prior to encryption, with leak-site publication as leverage. QILIN maintains a polished leak site with per-victim countdown timers and proof-of-theft data samples.

Dwell time: Observed dwell time in QILIN-attributed intrusions typically ranges from several days to roughly two weeks between initial access and detonation, with data staging and exfiltration concentrated in the final 48–72 hours. This is the detection window that matters.

Current Campaign Analysis

Sector Targeting (from this dataset of 14 listings)

Manufacturing and technology remain QILIN's bread and butter — sectors where operational downtime pressure maximizes payment probability and where sprawling, inconsistently patched environments are common. The inclusion of transportation infrastructure operators (Palletline in GB, Light Rail Manila in PH) and a U.S. municipality (City of Columbia, SC) is consistent with the group's opportunistic posture toward organizations with high availability requirements and constrained security budgets.

Geographic Concentration

Mexico is the most-represented country in this batch (4 listings: Sistemas Visuales 360, Farmacia I, Grupo Ciosa SAPI de CV, Innoe Asesores), followed by the United States (3 listings: Danser, Richland Resources Corporation, City of Columbia SC). Single listings span DE, TW, CI, GB, PH, RO, and JP — a global footprint consistent with affiliate-driven operations rather than a deliberately geofenced campaign.

Victim Profile

The batch skews toward mid-market organizations: regional manufacturers, logistics providers, professional services firms, a pharmacy, and a mid-size city government. Estimated revenue range across these profiles is roughly $10M–$500M — the classic RaaS sweet spot where organizations are large enough to pay meaningful ransoms but frequently lack 24/7 detection coverage.

Posting Frequency & Escalation

Twelve of the 14 listings were published on 2026-10-30, with one each on 2026-10-29 and 2026-11-01. This burst pattern — a single-day dump of a dozen claims — is characteristic of QILIN batch-publishing victims whose negotiations stalled simultaneously, rather than a reflection of same-day intrusions. The underlying intrusions, if real, likely occurred weeks apart.

CVE Exposure — Hypothesis, Not Attribution

We have no evidence linking any specific CVE to any named listing above. However, several entries currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use align with QILIN's known access patterns, and organizations in the targeted sectors should treat these as priority exposure:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): VPN-gateway exploitation is a documented ransomware initial access vector; perimeter device auth bypasses map directly to QILIN's observed preference for valid-session access without phishing.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: Management-plane compromise of the firewall itself enables both access and blind-spot creation.
• CVE-2026-59310 — VMware vCenter path traversal: Highly relevant given QILIN's ESXi-capable encryptor; vCenter compromise is the shortest path to mass hypervisor encryption.
• CVE-2026-63077 — JetBrains TeamCity deserialization: Build-server compromise enables supply-chain-style lateral movement with high-value credential access.
• CVE-2026-48027 — Nx Console embedded malicious code: Developer-workstation initial access via a poisoned IDE extension.

Treat these as sector-level exposure hypotheses for prioritizing patch and hunt activity — not as established intrusion vectors for any organization named in this briefing.

Detection Engineering

The Sigma rules below target QILIN's documented tradecraft: remote-access initial entry, living-off-the-land lateral movement (PsExec/WMI), and pre-encryption staging (shadow copy deletion, mass file discovery, exfil staging). Deploy in tandem with your existing ransomware canary and backup-integrity monitoring.

---
title: QILIN - Shadow Copy Deletion via vssadmin or wmic
id: 8f2a1c4e-7b3d-4e5f-9a1c-qilin00001
status: experimental
description: Detects deletion of Volume Shadow Copies, a hallmark pre-encryption step observed in QILIN intrusions. Fires on vssadmin, wmic shadowcopy delete, or bcdedit recoverydisabled changes.
author: Security Arsenal Threat Intel
date: 2026/11/01
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete catalog'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance (rare on servers outside change windows)
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: QILIN - PsExec-Style Remote Service Creation for Lateral Movement
id: 8f2a1c4e-7b3d-4e5f-9a1c-qilin00002
status: experimental
description: Detects remote service installation consistent with PsExec and clone tooling used by QILIN affiliates for lateral movement prior to mass encryption.
author: Security Arsenal Threat Intel
date: 2026/11/01
logsource:
  product: windows
  service: system
  definition: 'EventID 7045 - Service Installed'
detection:
  selection:
    EventID: 7045
  filter_paths:
    ServiceFileName|contains:
      - '\Windows\PSEXESVC'
      - 'ADMIN$'
      - '\Temp\'
      - '%COMSPEC%'
  condition: selection and filter_paths
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) - baseline known service names
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
---
title: QILIN - Suspicious Data Staging Archive Creation
id: 8f2a1c4e-7b3d-4e5f-9a1c-qilin00003
status: experimental
description: Detects mass archive creation with common exfiltration tools (7z, rar, WinRAR) operating against shares or large directories - matches QILIN pre-leak data staging behavior.
author: Security Arsenal Threat Intel
date: 2026/11/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - '.7z'
      - '.rar'
      - '\\'  # targeting UNC paths / shares
  filter_users:
    User|contains:
      - 'SYSTEM'
      - 'svc_backup'
  condition: selection_img and selection_cmd and not filter_users
falsepositives:
  - Nightly backup scripts - restrict by schedule and service account
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration

// QILIN pre-ransomware staging hunt: lateral movement + staging chain (Sentinel)
// Looks for hosts showing remote service creation, followed by archive tooling,
// followed by shadow copy tampering within a 72h window - QILIN's known compression window.
let Window = 72h;
let ServiceInstalls = SecurityEvent
| where TimeGenerated > ago(Window)
| where EventID == 7045
| where ServiceFileName has_any ("PSEXESVC", "ADMIN$", "\\Temp\\")
| project ServiceTime=TimeGenerated, Computer, ServiceName, ServiceAccount=Account;
let ArchiveActivity = DeviceProcessEvents
| where TimeGenerated > ago(Window)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe")
| where ProcessCommandLine has_any (".7z",".rar"," -r")
| project ArchiveTime=TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessAccountName;
let ShadowTamper = DeviceProcessEvents
| where TimeGenerated > ago(Window)
| where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe")
| where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","resize shadowstorage","recoveryenabled no","delete catalog")
| project TamperTime=TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessAccountName;
ServiceInstalls
| join kind=inner (ArchiveActivity) on $left.Computer == $right.DeviceName
| join kind=inner (ShadowTamper) on $left.Computer == $right.DeviceName1
| where ArchiveTime between (ServiceTime .. ServiceTime + 48h)
| where TamperTime between (ArchiveTime .. ArchiveTime + 24h)
| project Computer, ServiceName, ServiceTime, ArchiveTime, ArchiveCmd=ProcessCommandLine, TamperTime, TamperCmd=ProcessCommandLine1
| order by Computer asc, ServiceTime asc;

# QILIN Rapid Triage: shadow copies, recent scheduled tasks, RDP exposure
# Run on critical servers and domain controllers during suspected pre-detonation window.

Write-Host "=== [1] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
else { Write-Host "WARNING: No shadow copies present - possible T1490 tampering." -ForegroundColor Red }

Write-Host "`n=== [2] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\$($_.TaskName)"
  if (Test-Path $regPath) {
    $lm = (Get-Item $regPath).LastWriteTime
    if ($lm -gt (Get-Date).AddDays(-7)) {
      [PSCustomObject]@{ TaskName=$_.TaskName; LastModified=$lm; Author=$_.Author; Action=($_.Actions.Execute) }
    }
  }
} | Format-Table -AutoSize

Write-Host "`n=== [3] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$rdpEnabled = ($rdp.fDenyTSConnections -eq 0)
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
[PSCustomObject]@{
  RdpEnabled = $rdpEnabled
  NlaRequired = ($nla -eq 1)
  Risk = if ($rdpEnabled -and $nla -ne 1) { 'HIGH - RDP open without NLA' } elseif ($rdpEnabled) { 'MEDIUM - RDP enabled, verify firewall scoping' } else { 'LOW' }
} | Format-List

Write-Host "`n=== [4] Recent 7045 Service Installs (Last 7 Days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}} | Format-Table -AutoSize

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

QILIN's window between staging and detonation is typically 48–72 hours. Hunt for, in order:

1. Shadow copy / backup tampering — vssadmin delete shadows, bcdedit recoveryenabled no, backup-catalog deletion (T1490). This is the single highest-fidelity pre-detonation signal.
2. Mass archive creation on file servers or against \\ UNC paths, especially outside backup windows.
3. New service installations (7045) with binaries in %TEMP%, ADMIN$, or named to mimic legitimate services.
4. RMM tooling appearing for the first time — AnyDesk, ScreenConnect, Atera — a frequent QILIN affiliate exfil and access channel.
5. Unusual outbound volume to cloud storage (MEGA, mega.nz, Rclone-configured endpoints) from servers, not workstations.
6. ESXi/vCenter anomalies — unexpected datastore browsing, VM power-off events, new SSH sessions to hosts. QILIN ships an ESXi encryptor; hypervisor compromise is endgame.

Assets QILIN Historically Prioritizes for Exfiltration

• Finance and payroll data (maximizes leak embarrassment and regulatory exposure)
• HR records and employee PII
• Legal documents, contracts, and M&A material
• Customer databases and, for healthcare-adjacent victims, patient data
• For government victims: resident data, police-adjacent records — particularly relevant given the City of Columbia, SC listing

Containment Actions by Urgency

1. Isolate at the network layer, not the host layer — segment affected VLANs first; powering off hosts destroys forensic memory and can trigger dead-man's-switch encryption logic.
2. Disable suspicious accounts and revoke sessions — especially any account used for the 7045 service installs; force enterprise-wide credential reset if domain admin exposure is possible.
3. Block exfil channels at the egress — sinkhole Rclone/MEGA/cloud-storage destinations; QILIN's leverage dies with the data theft.
4. Protect backups actively — verify offline/immutable copies are actually unreachable from the production network right now, not in policy.
5. Preserve evidence before remediation — capture memory on staging hosts, export relevant event logs, snapshot (don't rebuild) affected VMs.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV perimeter exposures: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077), and audit developer workstations for Nx Console (CVE-2026-48027). If patching isn't possible inside 24h, isolate the management interfaces from general network reachability.
• Enforce MFA on all remote access — VPN, RDP gateways, and especially RMM tooling. QILIN's access patterns consistently exploit single-factor remote entry.
• Deploy the Sigma rules above and alert on shadow-copy tampering at high priority with automated host isolation.
• Audit 7045 service-install events environment-wide for the past 30 days.
• Verify backup immutability and confirm backup infrastructure is not domain-joined or reachable with production credentials.

Short-Term (2 weeks)

• Segment backup and hypervisor management planes onto dedicated networks with jump-host-only access; vCenter should never be reachable from general user VLANs.
• Deploy application control (WDAC/AppLocker) to block unauthorized archiving and RMM binaries; maintain an allowlist of approved remote-access tools and alert on everything else.
• Implement egress filtering with DLP-aware alerting on bulk outbound transfer from servers.
• Enable tamper protection on EDR and ensure shadow-copy deletion attempts trigger isolation, not just alerts.
• Tabletop the 48–72 hour staging-to-detonation scenario with IT, legal, and communications — QILIN's leak-site cadence means the public-extortion clock may already be running when you detect.

All organizations named in this briefing appear solely as claims on QILIN's leak site. Security Arsenal has not independently verified any breach. Named organizations are encouraged to contact security@securityarsenal.com regarding corrections.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub