QILIN Ransomware Gang: 15 New Victims Posted in 72 Hours — Cross-Sector Campaign Targeting Energy, Hospitality & Manufacturing

Classification: TLP:CLEAR | Published: 2026-08-22 | Analyst Desk: Security Arsenal — From The Dark Side

Security Arsenal's dark web monitoring of QILIN's .onion leak site confirms an aggressive publishing cadence over the last 72 hours: 15 victims disclosed between 2026-08-19 and 2026-08-21, spanning 8 countries and 8 industry verticals. This is not opportunistic sprawl — the victim mix and the timing correlation with several CISA KEV additions point to a deliberate, infrastructure-exploitation-driven campaign. Enterprise defenders in energy, hospitality, and manufacturing should treat this as an active-threat window.

1. Threat Actor Profile — QILIN

QILIN's affiliates are technically heterogeneous — because it is RaaS, TTPs vary by affiliate. However, a consistent playbook has emerged across 2025–2026 intrusions: perimeter appliance exploitation for entry, legitimate remote administration tooling for lateral movement, bulk archive staging (7z/RAR) to cloud storage or attacker-controlled FTP, then simultaneous encryptor deployment via GPO, PsExec, or WMI.

2. Current Campaign Analysis

2.1 Sector Targeting

The 15 most recent leak-site postings break down as follows:

Analysis: The cluster of Mexican industrial and energy-adjacent victims (Quaker State Mexico, Constructora Jimenez, Cinépolis) posted on the same two-day window suggests a single affiliate working a regional access pipeline — most plausibly a shared exploited appliance or a common MSP/RMM exposure. The hospitality entries (iPic, Cinépolis — both cinema/entertainment operators) hint at a possible shared technology stack or vendor compromise.

2.2 Geographic Concentration

• Mexico (MX): 4 victims — the single largest cluster, consistent with a regional affiliate push
• United States (US): 4 victims
• India, Philippines, South Africa, Netherlands, Spain, Germany, Peru: 1 victim each

QILIN's historical US/EU focus is intact, but the LATAM tilt in this batch mirrors a broader 2026 RaaS trend: affiliates pursuing softer patch cadences and weaker MFA adoption in emerging-market enterprises while keeping US victims in the pipeline for high-value extortion.

2.3 Victim Profile

The victim set skews toward mid-market enterprises (est. 200–2,500 employees; ~$20M–$500M annual revenue) — the classic RaaS sweet spot: large enough to pay meaningful ransoms, small enough to lack 24/7 SOC coverage and mature EDR rollout. Notably, Cinépolis (large multinational cinema chain) and Quaker State Mexico sit at the larger end, indicating QILIN affiliates are willing to take on enterprise-scale targets when perimeter access is cheaply available.

2.4 Posting Frequency & Escalation

A 15-victim disclosure in ~72 hours is an elevated cadence for QILIN (historical baseline: 3–6 postings/week). Because leak-site postings lag intrusion by days to weeks (negotiation window), the actual intrusion wave likely occurred in late July through mid-August 2026. Defenders should assume additional unposted victims are currently in negotiation and that the same access vector(s) may still be live in other environments.

2.5 CVE Correlation — Probable Initial Access Vectors

The CISA KEV entries flagged with confirmed ransomware use align tightly with QILIN's known entry playbook:

Working assessment: CVE-2026-50751 (Check Point) is the most likely common-denominator vector for the regional cluster, with CVE-2024-1708 (ScreenConnect) as the probable lateral/deployment multiplier. Organizations running either product should initiate threat hunts immediately, even if patched after the KEV date — patch timing does not equal eviction.

3. Detection Engineering

3.1 Sigma Rules

The following rules target the specific TTPs in QILIN's affiliate playbook: VPN/perimeter exploitation artifacts, remote execution tooling for lateral movement, and pre-encryption staging (shadow copy deletion, archive exfiltration).

---
title: QILIN - Suspicious Check Point VPN Anomalous Authentication Followed by Interactive Session
id: 9f3a2c10-7d4b-4e8a-9c1a-qilincp0001
status: experimental
description: Detects anomalous IKEv1/VPN authentication events followed by interactive logon or process execution consistent with CVE-2026-50751 exploitation patterns used by QILIN affiliates.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://securityarsenal.com/darkside
logsource:
    category: authentication
    product: checkpoint
detection:
    selection_ike:
        event_type:
            - 'IKEv1 authentication'
            - 'VPN login'
    selection_anomaly:
        auth_result: 'success'
        source_ip|contains:
            - 'TOR'
            - 'unknown'
        user_account|contains:
            - 'admin'
            - 'vpnuser'
    filter_known:
        source_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
    condition: selection_ike and selection_anomaly and not filter_known
falsepositives:
    - Legitimate remote admins on rotating ISP IPs
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1133
---
title: QILIN - PsExec or WMI Remote Service Creation for Encryptor Deployment
id: 8e2b1d20-5c3a-4f7b-8d2b-qilinpsexec
status: experimental
description: Detects remote service installation via PsExec-like tooling or WMI, a hallmark of QILIN's mass encryptor deployment phase across domain hosts.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\psexec.exe'
            - '\paexec.exe'
            - '\csexec.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_service:
        EventID: 7045
        ServiceFileName|contains:
            - 'ADMIN$'
            - '\\'
            - 'AppData\\Local\\Temp'
    condition: selection_psexec or selection_wmi or selection_service
falsepositives:
    - SCCM/Intune legitimate software pushes
    - IT admin remote maintenance
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
---
title: QILIN - Pre-Encryption Staging - Shadow Copy Deletion and Bulk Archive Exfiltration
id: 7d1c0e30-4b2a-4e6c-9c3c-qilinstage
status: experimental
description: Detects Volume Shadow Copy deletion combined with bulk archive creation (7z/RAR) to temp or public folders - the final staging pattern observed 24-72h before QILIN detonation.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
          CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
        - Image|endswith: '\bcdedit.exe'
          CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - ' -p'
            - 'C:\\ProgramData'
            - 'C:\\Users\\Public'
            - '$Recycle.Bin'
    timeframe: 15m
    condition: selection_vss or selection_archive
falsepositives:
    - Backup software operations
    - Legitimate IT compression tasks
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.exfiltration

3.2 KQL Hunt — Microsoft Sentinel

Hunt for the pre-ransomware staging window: remote execution tooling, suspicious archive creation, and shadow copy tampering within a 72-hour lookback — the signature of a QILIN affiliate in final-approach before detonation.

// QILIN Pre-Ransomware Staging Hunt - 72h lookback
// Looks for: PsExec/WMI lateral movement + archive staging + VSS tampering co-occurrence on same host
let TimeWindow = 72h;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where Timestamp > ago(TimeWindow)
    | where FileName in~ ("PSEXESVC.exe", "psexec.exe", "paexec.exe")
        or (InitiatingProcessFileName =~ "WmiPrvSE.exe"
            and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe"))
    | project RemoteExecTime = Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName;
let ArchiveStaging =
    DeviceProcessEvents
    | where Timestamp > ago(TimeWindow)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any ("ProgramData", "Users\\Public", " a ", "-p")
    | project ArchiveTime = Timestamp, DeviceName, ArchiveCmd = ProcessCommandLine;
let VSSTampering =
    DeviceProcessEvents
    | where Timestamp > ago(TimeWindow)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "ignoreallfailures"))
        or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
    | project VSSTime = Timestamp, DeviceName, VSSCmd = ProcessCommandLine;
SuspiciousRemoteExec
| join kind=inner ArchiveStaging on DeviceName
| join kind=inner VSSTampering on DeviceName
| where abs(datetime_diff('minute', VSSTime, RemoteExecTime)) < 1440
| summarize FirstSeen = min(RemoteExecTime), LastSeen = max(VSSTime),
    RemoteExecCommands = make_set(ProcessCommandLine, 3),
    ArchiveCommands = make_set(ArchiveCmd, 3),
    VSSCommands = make_set(VSSCmd, 3)
    by DeviceName, AccountName
| extend RiskScore = "CRITICAL - QILIN detonation pattern"
| order by FirstSeen desc;

3.3 Rapid Response Script — Last-7-Days Persistence & Staging Audit

Run this on any host flagged by the Sigma rules or KQL hunt. It enumerates recently created scheduled tasks, services, and Temp/Public archive artifacts, and verifies Volume Shadow Copy integrity.

# Security Arsenal - QILIN Pre-Detonation Triage Script
# Run as Administrator. Outputs evidence for IR scoping.
# Usage: .\qilin-triage.ps1 | Tee-Object -FilePath "triage_$env:COMPUTERNAME.txt"

Write-Host "=== [1] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_
    [PSCustomObject]@{
        TaskName   = $_.TaskName
        TaskPath   = $_.TaskPath
        Author     = $_.Author
        LastRun    = $info.LastRunTime
        NextRun    = $info.NextRunTime
        Action     = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    }
} | Where-Object { $_.TaskPath -notlike '*Microsoft*' } | Format-Table -AutoSize

Write-Host "=== [2] Services Installed in Last 7 Days (PsExec/encryptor push check) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated,
        @{N='ServiceName';E={$_.Properties[0].Value}},
        @{N='BinaryPath';E={$_.Properties[1].Value}},
        @{N='StartType';E={$_.Properties[2].Value}},
        @{N='Account';E={$_.Properties[4].Value}} | Format-Table -AutoSize

Write-Host "=== [3] Archive Artifacts in Staging Locations (exfil staging check) ===" -ForegroundColor Cyan
Get-ChildItem -Path "C:\ProgramData","C:\Users\Public","C:\Windows\Temp" -Recurse -Depth 2 -ErrorAction SilentlyContinue |
    Where-Object { $_.Extension -in '.7z','.rar','.zip','.gz' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 50MB } |
    Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize

Write-Host "=== [4] Volume Shadow Copy Integrity ===" -ForegroundColor Cyan
$shadows = vssadmin list shadows 2>&1
if ($shadows -match 'No items found') {
    Write-Host "[!!!] NO SHADOW COPIES FOUND - possible vssadmin deletion (T1490) [!!!]" -ForegroundColor Red
} else { $shadows }

Write-Host "=== [5] Suspicious Recent Executables in Non-Standard Paths ===" -ForegroundColor Cyan
Get-ChildItem -Path "C:\ProgramData","C:\Users\Public","C:\Perflogs" -Recurse -Depth 2 -Include *.exe,*.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize

Write-Host "=== Triage complete. Preserve output before any containment actions. ===" -ForegroundColor Green

4. Incident Response Priorities — QILIN Playbook

4.1 T-Minus Detection Checklist (Before Encryption Fires)

If you detect any of the following, assume you are inside QILIN's 48–72h pre-detonation window:

• VPN/perimeter anomalies: IKEv1 authentication successes from unrecognized IPs, admin logins outside change windows (CVE-2026-50751 indicator)
• RMM tool drift: ScreenConnect, AnyDesk, or Splashtop instances you did not deploy, or sessions from your RMM outside maintenance windows (CVE-2024-1708 indicator)
• New local admin accounts or unexpected group membership changes (privilege escalation via CVE-2025-60710)
• PsExec/WMI service creation events (7045) targeting multiple hosts from a single source
• Large 7z/RAR archives (>50MB) appearing in ProgramData, Users\Public, or Recycle.Bin paths
• Outbound transfer spikes to consumer cloud storage (MEGA, pCloud, temp.sh, file.io) or unfamiliar FTP endpoints
• vssadmin/bcdedit execution — if you see this, assume detonation is imminent (hours, not days)

4.2 Assets QILIN Historically Prioritizes for Exfiltration

QILIN negotiators demonstrably mine exfiltrated data to price ransom demands. Their affiliates prioritize:

1. Financial records — accounting exports, payroll, banking details (used to calibrate demand size)
2. PII/PHI databases — customer and employee records (regulatory leverage)
3. Legal and contractual documents — especially relevant given The Pendas Law Firm posting; legal-sector data is high-leverage extortion material
4. Source code and engineering data — for Technology/Manufacturing victims (Provite, Estech, Gindre)
5. Email archives of executive leadership — negotiation leverage and secondary social engineering material

4.3 Containment Actions — Ordered by Urgency

1. (0–15 min) Disable compromised VPN/perimeter appliance access; force re-authentication of all active sessions; rotate all VPN and domain admin credentials
2. (15–60 min) Isolate affected hosts at the network layer (do NOT power off — preserve memory); block identified exfil destinations at egress
3. (1–4 h) Disable any unauthorized RMM agents; audit and disable suspicious scheduled tasks and services enterprise-wide (script in §3.3)
4. (4–24 h) Reset KRBTGT twice if domain controller compromise is suspected; hunt all Tier-0 assets for the lateral movement patterns above
5. (24–72 h) Engage IR retainer before contacting or responding to any extortion communication; preserve leak-site evidence for legal/regulatory assessment

5. Hardening Recommendations

5.1 Immediate (24 Hours)

• Patch Check Point Security Gateway against CVE-2026-50751 — if IKEv1 is not required, disable it entirely. If patching is deferred, restrict management and VPN interfaces to allowlisted source IPs
• Patch or isolate ConnectWise ScreenConnect (CVE-2024-1708) — inventory all RMM tools in your environment; anything unmanaged should be treated as hostile
• Patch Exchange Server (CVE-2023-21529) and apply Microsoft LAPS / credential hygiene to blunt CVE-2025-60710 privilege escalation
• Enforce phishing-resistant MFA (FIDO2) on all remote access, VPN, and RMM administrative interfaces
• Deploy the Sigma rules in §3.1 and run the KQL hunt across your fleet today — a single VSS-deletion event on a server is a pager-worthy finding
• Block consumer file-sharing exfil destinations (MEGA, file.io, temp.sh) at the proxy/egress layer unless business-justified

5.2 Short-Term (2 Weeks)

• Microsegment backup infrastructure — QILIN affiliates actively hunt backup consoles to destroy recovery options before detonation; backups must be unreachable from the production domain
• Implement application control (WDAC/AppLocker) blocking unsigned execution from ProgramData, Users\Public, and Temp paths — this breaks the encryptor staging pattern
• Restrict PsExec/WMI lateral movement — disable SMBv1, restrict remote service creation to a jump-host tier, alert on any 7045 event outside your deployment tooling
• Stand up dark web monitoring for your organization's name and domains on QILIN's leak site and affiliated channels — a posting is often the first notification a victim receives
• Tabletop the extortion scenario — legal, comms, and executive stakeholders should know who decides, who negotiates (or doesn't), and what regulatory clocks start ticking on data exposure

Assessment Summary

QILIN's current cadence — 15 victims in 72 hours with a pronounced Mexican industrial cluster — indicates at least one affiliate operating a repeatable, likely perimeter-exploitation-based access pipeline. The convergence of the Check Point CVE-2026-50751 KEV timeline with this posting wave is the strongest actionable signal for defenders: if you run Check Point Security Gateway, hunt now; do not wait for an extortion note.

Security Arsenal will continue monitoring QILIN's leak site and will update this briefing if posting cadence or targeting shifts.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub