QILIN Ransomware Gang: 15 New Victims in 4 Days — Cross-Sector Campaign & Critical Vulnerability Exploitation

---
title: Potential QILIN Ransomware Activity - ConnectWise ScreenConnect Exploitation
id: 9e3d6c4a-f8b2-45a6-8c5e-1d2f3e4b5c6d
status: stable
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect, commonly used by QILIN for initial access
author: Security Arsenal Threat Intel
date: 2026/05/15
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
    - https://connectwise.com/trust-center/security-advisories
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'ScreenConnect'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Legitimate ScreenConnect administrative access
level: high
---
title: Potential QILIN Lateral Movement - PsExec and WMI Execution
id: a2b3c4d5-e6f7-8a9b-c0d1-e2f3a4b5c6d7
status: stable
description: Detects patterns of lateral movement commonly used by QILIN affiliates using PsExec and WMI
author: Security Arsenal Threat Intel
date: 2026/05/15
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://attack.mitre.org/techniques/T1047/
tags:
    - attack.lateral_movement
    - attack.t1021
    - attack.t1047
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 5145
        ShareName: 'ADMIN$'
        RelativeTargetName|contains: 'PSEXESVC'
    selection_wmi:
        EventID: 4688
        NewProcessName|endswith: '\\wmiprvse.exe'
        CommandLine|contains: 'invoke-command'
    condition: 1 of selection*
falsepositives:
    - Legitimate system administration activities
level: high
---
title: Potential QILIN Data Exfil Patterns - Large File Transfers
id: c3d4e5f6-a7b8-c9d0-e1f2-a3b4c5d6e7f8
status: stable
description: Detects patterns of data exfiltration commonly associated with QILIN's double extortion tactics
author: Security Arsenal Threat Intel
date: 2026/05/15
references:
    - https://attack.mitre.org/techniques/T1041/
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 
            - 'C$'
            - 'ADMIN$'
    filter_large:
        AccessMask|contains: '0x1'  # FILE_READ_DATA
    timeframe: 5m
    condition: selection | count() > 10 and filter_large
falsepositives:
    - Legitimate backup operations
    - System administration tasks
level: medium

// Hunt for potential QILIN ransomware precursors
// Look for lateral movement, data staging, and credential theft
let TimeFrame = 7d;
let LateralMovement = 
    SecurityEvent
    | where TimeGenerated >= ago(TimeFrame)
    | where EventID in (5140, 5145, 4624, 4625, 4688)
    | where Computer in~ (
        // Potential jump hosts
        "DC*", 
        "FILE*",
        "SQL*"
    )
    | project TimeGenerated, Computer, EventID, Account, SubjectUserName, NewProcessName, CommandLine, ShareName, RelativeTargetName
    | extend Severity = case(
        EventID == 4625, "High",  // Failed login
        EventID == 5145 and ShareName == "ADMIN$", "High",  // Admin share access
        EventID == 4688 and CommandLine has "powershell" and (CommandLine has "encodedcommand" or CommandLine has "downloadstring"), "Critical",  // Suspicious PowerShell
        "Medium"
    );
let DataStaging = 
    DeviceFileEvents
    | where TimeGenerated >= ago(TimeFrame)
    | where ActionType == "FileCreated"
    | where FileName has_any (@".7z", ".rar", ".zip", ".tar") and InitiatingProcessAccountName != "SYSTEM"
    | project TimeGenerated, DeviceName, FileName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath
    | extend Severity = "High";
let SuspiciousScheduledTasks = 
    DeviceProcessEvents
    | where TimeGenerated >= ago(TimeFrame)
    | where FileName has "schtasks.exe"
    | where ProcessCommandLine has_any (@"/create", "/run") and ProcessCommandLine has_any (@"/sc minute", "/sc hourly")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
    | extend Severity = "Critical";
union LateralMovement, DataStaging, SuspiciousScheduledTasks
| order by TimeGenerated desc

<#
.SYNOPSIS
    QILIN Ransomware Detection and Hardening Script
.DESCRIPTION
    Performs detection checks for QILIN ransomware indicators and implements immediate hardening measures
.NOTES
    Author: Security Arsenal Threat Intel
    Date: 2026-05-15
#>

param(
    [switch]$AuditOnly,
    [string]$OutputPath = "C:\Windows\Temp\QilinDetection_$(Get-Date -Format 'yyyyMMdd').log"
)

function Write-Log {
    param([string]$Message, [string]$Level="INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "[$timestamp] [$Level] $Message" | Out-File -FilePath $OutputPath -Append
    switch ($Level) {
        "CRITICAL" { Write-Host $Message -ForegroundColor Red }
        "WARNING"  { Write-Host $Message -ForegroundColor Yellow }
        "INFO"     { Write-Host $Message -ForegroundColor Green }
        default    { Write-Host $Message }
    }
}

# Check for recent suspicious scheduled tasks
Write-Log "Checking for suspicious scheduled tasks created in the last 7 days..."
$suspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and 
    $_.TaskName -notmatch "Microsoft|Windows|Adobe|Google|Update"
}

if ($suspiciousTasks.Count -gt 0) {
    Write-Log "Found $($suspiciousTasks.Count) potentially suspicious scheduled tasks:" "CRITICAL"
    $suspiciousTasks | ForEach-Object {
        Write-Log "Task: $($_.TaskName), Created: $($_.Date), Author: $($_.Author)" "WARNING"
        if (!$AuditOnly) {
            try {
                Disable-ScheduledTask -TaskName $_.TaskName -ErrorAction Stop
                Write-Log "Disabled task: $($_.TaskName)" "INFO"
            } catch {
                Write-Log "Failed to disable task: $($_.TaskName) - $($_.Exception.Message)" "WARNING"
            }
        }
    }
} else {
    Write-Log "No suspicious scheduled tasks found in the last 7 days." "INFO"
}

# Check for unusual RDP connections
Write-Log "Checking for RDP connections in the last 24 hours..."
$rdpEvents = Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
    ID=21
    StartTime=(Get-Date).AddHours(-24)
} -ErrorAction SilentlyContinue

if ($rdpEvents) {
    Write-Log "Found $($rdpEvents.Count) RDP connections in the last 24 hours:" "INFO"
    $rdpEvents | ForEach-Object {
        $eventXml = [xml]$_.ToXml()
        $user = $eventXml.Event.EventData.Data[0].'#text'
        $sourceIP = $eventXml.Event.EventData.Data[2].'#text'
        Write-Log "User: $user, Source IP: $sourceIP" "INFO"
    }
} else {
    Write-Log "No RDP connections found in the last 24 hours." "INFO"
}

# Check for modified Volume Shadow Copies
Write-Log "Checking for modified Volume Shadow Copies in the last 7 days..."
$vssChanges = vssadmin list shadows /for=c: 2>$null | Select-String "Shadow Copy Volume"
if ($vssChanges) {
    Write-Log "Volume Shadow Copies found:" "INFO"
    $vssChanges | ForEach-Object { Write-Log $_.Line.ToString() "INFO" }
} else {
    Write-Log "No Volume Shadow Copies found or accessible." "WARNING"
}

# Check for signs of data exfiltration (large compressed files)
Write-Log "Scanning for recently created compressed files..."
$compressedFiles = Get-ChildItem -Path "C:\" -Recurse -Include @("*.zip", "*.rar", "*.7z", "*.tar") -ErrorAction SilentlyContinue | 
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-3) -and $_.Length -gt 100MB }

if ($compressedFiles.Count -gt 0) {
    Write-Log "Found $($compressedFiles.Count) recently created large compressed files:" "CRITICAL"
    $compressedFiles | ForEach-Object {
        Write-Log "File: $($_.FullName), Size: $([math]::Round($_.Length / 1MB, 2)) MB, Created: $($_.CreationTime)" "WARNING"
    }
} else {
    Write-Log "No suspicious compressed files found." "INFO"
}

# Immediate hardening checks
if (!$AuditOnly) {
    Write-Log "Applying immediate hardening measures..." "INFO"
    
    # Disable RDP if not required
    $rdpStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
    if ($rdpStatus -ne 1) {
        Write-Log "Disabling RDP..." "WARNING"
        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1
        Write-Log "RDP has been disabled." "INFO"
    }
    
    # Check for SMBv1
    $smbv1 = Get-WindowsFeature -Name FS-SMB1
    if ($smbv1.Installed) {
        Write-Log "Disabling SMBv1..." "WARNING"
        Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
        Write-Log "SMBv1 has been disabled." "INFO"
    }
    
    Write-Log "Hardening measures applied. System reboot may be required for some changes." "INFO"
}

Write-Log "QILIN detection and hardening check complete." "INFO"