QILIN Ransomware Gang: 16 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules | Security Arsenal

Classification: TLP:CLEAR | Publication Date: 2026-10-18 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Security Arsenal's dark web monitoring has identified 16 new organizations listed on the QILIN ransomware gang's leak site between 2026-10-15 and 2026-10-18. These are claims made by a criminal threat actor — not confirmed breaches. The claimed victims span Education, Energy & Utilities, Transportation, Manufacturing, Financial Services, Technology, and Retail, with geographic reach across the US, Malaysia, Netherlands, Germany, Italy, Thailand, Japan, Spain, South Korea, and Nigeria.

Notable patterns in this posting wave: two US credit unions (Via Credit Union and Telcoe Federal Credit Union) and a US school district (Llano Independent School District) appear in the same window, consistent with QILIN's historical preference for mid-market organizations with limited security budgets and high pressure to restore operations quickly. An energy/water utility claim in Malaysia (Pengurusan Aset Air Berhad) continues the gang's documented interest in critical infrastructure adjacent targets.

Organizations in the affected sectors — regardless of whether they appear on the list — should treat this as a trigger to validate VPN/edge device patching, audit remote access exposure, and run the hunting queries provided below.

Sourcing & Verification

6 of 16 listings were independently observed by a second leak-site crawler (Llano Independent School District, Pengurusan Aset Air Berhad, BRUTRA Logistek, Pergande, Mastelli S.r.l., First Brothers Co., Ltd). 10 of 16 listings appear on a single source (ransomware.live) only, with no second-crawler confirmation that the posting even exists.
Inclusion in this briefing reflects the threat actor's claim only. It is NOT confirmation of a breach, intrusion, or data theft at any named organization. No corroboration tier in this data confirms a breach — only the organization itself or its regulator can do that.
A named organization may dispute a listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — QILIN

Aliases: Qilin, Agenda (early variant naming observed in 2022-era reporting)

Operational model: Ransomware-as-a-Service (RaaS). QILIN operates a structured affiliate program, typically offering affiliates 80–85% of ransom proceeds, with the core team maintaining the leak site, negotiation infrastructure, and encryptor development. The encryptor is written primarily in Rust and Go, with builds targeting Windows, Linux, and ESXi — making hypervisor-level encryption a signature endgame.

Ransom demands: Highly variable and scaled to victim revenue. Demands against mid-market organizations typically range from the low hundreds of thousands to several million USD. QILIN negotiators are known to reference the victim's cyber insurance policy limits during negotiation when policy documents are found during exfiltration.

Initial access methods (known, sector-level):

Spear phishing with malicious attachments or links leading to loader malware
Exploitation of exposed remote access — VPN appliances, RDP, and unpatched edge devices
Valid accounts (purchased or phished credentials) against remote access services lacking MFA
Exploitation of known vulnerabilities in internet-facing infrastructure shortly after disclosure

Double extortion: QILIN is a committed double-extortion operator. Data is staged and exfiltrated before encryption, and the leak site is used as leverage: victims are listed with countdown timers, escalating sample-data releases, and direct threats of full publication. Listing on the site generally indicates the gang claims negotiations failed or stalled.

Dwell time: Observed dwell time from initial access to detonation typically ranges from several days to roughly two weeks, though affiliates vary widely. The exfiltration phase — the noisiest part of the operation — usually occurs in the final 24–72 hours before encryption.

Current Campaign Analysis

Sector targeting

The current posting wave shows deliberate breadth rather than single-sector focus: Education, Energy & Utilities, Transportation (two listings), Financial Services (two credit unions), Manufacturing, Technology (two listings), and Retail & E-Commerce. The clustering of US credit unions and a US school district fits QILIN's affiliate playbook of pursuing organizations with regulatory reporting pressure, tight operational uptime requirements, and — historically — thinner detection coverage.

Geographic concentration

The US leads with five claimed victims, followed by a broad APAC/European spread: MY, NL, DE, IT, TH, JP, ES, KR, NG. This global dispersion is typical of a mature RaaS with multiple affiliates working independent access pipelines, rather than a single coordinated intrusion set.

Victim profile

The named organizations skew mid-market: regional credit unions, a school district, a logistics firm, a specialty manufacturer, a water utility operator, and SMB retailers. Revenue estimates based on sector norms place most in the tens to low hundreds of millions USD — the classic RaaS sweet spot where ransom demands in the mid-six to low-seven figures are both painful and plausibly payable.

Posting frequency / escalation pattern

Sixteen postings in four days (2026-10-15 through 2026-10-18), with a notable burst of six multi-source-confirmed postings on the final day. This cadence suggests either batch-publishing of stalled negotiations or an affiliate pushing multiple victims to the pressure phase simultaneously. Watch for sample-data dumps within 72–96 hours of listing as the typical escalation step.

CVE exposure hypothesis (sector-level, NOT victim attribution)

We have no evidence linking any specific named organization to any specific CVE. That said, QILIN affiliates are known to rapidly operationalize edge and management-plane vulnerabilities, and the following CISA KEV entries (all confirmed ransomware-associated) represent the exposure classes defenders should assume are in play:

CVE-2026-59310 — VMware vCenter path traversal. Directly relevant given QILIN's ESXi-focused encryptors; vCenter compromise is a force multiplier for hypervisor-level encryption.
CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise of the firewall enables both access and blind-spot creation.
CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). VPN gateway compromise is a documented QILIN-family access vector.
CVE-2026-63077 — JetBrains TeamCity deserialization. Build-server compromise enables supply-chain-style payload signing and lateral trust abuse.
CVE-2026-48027 — Nx Console embedded malicious code. Developer workstation tooling as an initial foothold.

Treat these as sector-level exposure hypotheses for hardening prioritization — not as attribution for any listing.

Detection Engineering

The following rules target QILIN's known playbook: edge/VPN access, credential-based lateral movement via PsExec/WMI, staging and exfiltration before encryption, and the pre-detonation cleanup phase (shadow copy deletion, backup tampering).

YAML

---
title: QILIN Pre-Encryption - Volume Shadow Copy Deletion
id: 9a7c2e11-q1l1-4a01-9001-qln000000001
status: experimental
description: Detects deletion or manipulation of Volume Shadow Copies via vssadmin, wmic, or PowerShell - a hallmark QILIN pre-encryption anti-recovery step observed across affiliate operations.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\vssadmin.exe'
    - Image|endswith: '\wmic.exe'
    - Image|endswith: '\powershell.exe'
    - Image|endswith: '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Delete-WmiObject'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: selection_img and selection_cmd
falsepositives:
  - Backup software maintenance
  - System administrators performing storage reclamation
level: high
tags:
  - attack.impact
  - attack.t1490
date: 2026/10/18
---
title: QILIN Lateral Movement - PsExec or WMI Remote Service Creation
id: 9a7c2e11-q1l1-4a01-9001-qln000000002
status: experimental
description: Detects remote service creation and PsExec-style execution patterns used by QILIN affiliates for lateral movement and mass encryptor deployment across domain hosts.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_svc:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
  selection_path:
    ImagePath|contains:
      - 'ADMIN$'
      - '\Temp\'
      - '\Users\Public\'
      - 'cmd.exe /c'
  condition: selection_event and (selection_svc or selection_path)
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) - baseline service names in your environment
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1021.002
date: 2026/10/18
---
title: QILIN Data Staging - Archive Creation of Sensitive Directories
id: 9a7c2e11-q1l1-4a01-9001-qln000000003
status: experimental
description: Detects compression of high-value directories (finance, HR, shares, databases) using rar, 7z, or similar tools - consistent with QILIN double-extortion staging prior to exfiltration.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip.exe'
      - '\bsdtar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' -r'
  selection_target:
    CommandLine|contains:
      - '\Finance'
      - '\HR'
      - '\Payroll'
      - '\Shares'
      - '\Accounting'
      - '\\'
      - '.bak'
      - '.mdf'
      - '.ldf'
      - '.pst'
  condition: selection_img and selection_cmd and selection_target
falsepositives:
  - Scheduled backup jobs using compression - exclude known backup service accounts
level: medium
tags:
  - attack.collection
  - attack.t1560.001
date: 2026/10/18

KQL — Microsoft Sentinel / Defender

// QILIN Hunt: Lateral movement + pre-ransomware staging correlation (Microsoft Sentinel)
// Looks for hosts exhibiting BOTH remote execution artifacts AND archive/staging activity
// within a 4-hour window - the typical QILIN exfil-before-encryption burst.
let Lookback = 7d;
let CorrelationWindow = 4h;
let RemoteExec =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC","PAExec","remcom")
        or ServiceFileName has_any ("ADMIN$","\\Temp\\","\\Users\\Public\\")
    | project RemoteExecTime = TimeGenerated, Computer, Account, ServiceName, ServiceFileName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where FileName in~ ("rar.exe","7z.exe","7za.exe","bsdtar.exe")
       or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","resize shadowstorage")
    | project StagingTime = TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
RemoteExec
| join kind=inner (Staging) on $left.Computer == $right.DeviceName
| where abs(datetime_diff('minute', StagingTime, RemoteExecTime)) <= (CorrelationWindow / 1m * 60)
| summarize FirstSeen = min(RemoteExecTime), LastSeen = max(StagingTime),
    Artifacts = make_set(ServiceFileName), StagingCmds = make_set(ProcessCommandLine)
    by Computer, Account
| extend RiskNote = "Host shows remote-exec service creation correlated with archive/shadowcopy activity within window - investigate for QILIN-style pre-detonation staging"
| order by FirstSeen desc;

PowerShell

# QILIN Rapid Triage: edge exposure + persistence + anti-recovery indicators
# Run elevated on suspect hosts or via your EDR's live-response shell.

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) {
    Write-Warning "RDP ENABLED. Network profile NLA: $((Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name SecurityLayer -ErrorAction SilentlyContinue).SecurityLayer)"
} else { Write-Host "RDP disabled." }

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days (QILIN persistence vector) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | ForEach-Object Execute) -join '; '}} | Format-List

Write-Host "=== [3] Volume Shadow Copy Inventory (expect zero = anti-recovery indicator) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Warning "NO shadow copies present - investigate vssadmin/wmic deletion events NOW." }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table }

Write-Host "=== [4] New Local Admin Accounts in Last 14 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-14)
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    $u = Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction SilentlyContinue
    if ($u -and $u.PasswordLastSet -gt $cutoff) {
        Write-Warning "Recent admin: $($_.Name) | PasswordLastSet: $($u.PasswordLastSet)"
    }
}

Write-Host "=== [5] vssadmin / rar / 7z execution artifacts in prefetch ===" -ForegroundColor Cyan
Get-ChildItem 'C:\Windows\Prefetch' -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'VSSADMIN|WMIC|RAR|7Z|PSEXEC' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object Name, LastWriteTime | Format-Table

Incident Response Priorities

T-minus detection checklist (BEFORE encryption fires)

vssadmin/wmic shadow deletion events — the single highest-fidelity pre-detonation signal. Alert on any occurrence outside approved backup windows.
New service installations (Event ID 7045) on multiple hosts within hours — mass encryptor deployment indicator.
Bulk archive creation (rar/7z against finance/HR/share paths) — exfiltration staging in progress.
Unusual outbound volume to cloud storage, MEGA-style services, or unknown VPS endpoints — exfil in flight.
Group Policy modifications pushing scripts or disabling security tools across the domain.
Backup platform tampering — deleted jobs, expired retention, inaccessible Veeam/Commvault consoles.
ESXi/vCenter anomalies — unexpected vCenter logins, host maintenance-mode flapping, VM power-offs.

Assets QILIN historically prioritizes for exfiltration

Financial records, payroll, and banking details (leverage + fraud resale)
HR/PII stores (regulatory pressure multiplier)
Legal contracts, M&A material, insurance policies (used to calibrate ransom)
Email archives of executives (negotiation leverage)
For utilities/OT-adjacent victims: engineering diagrams and operational documentation

Containment actions, ordered by urgency

Isolate, don't nuke: Segment suspected hosts at the switch/EDR level. Preserve memory and volatile artifacts — you'll need them to scope access.
Disable compromised and service accounts; force domain-wide credential resets for any account seen on staging hosts (krbtgt twice if domain compromise is suspected).
Block exfil egress at the proxy/firewall for bulk-transfer destinations; inspect TLS where lawful.
Take vCenter/ESXi management interfaces offline from general network reach; snapshot critical VMs if hypervisor integrity is uncertain.
Verify offline/immutable backup integrity before declaring a recovery posture — assume attackers checked them too.
Engage IR retainers, legal counsel, and your insurer early; regulatory clocks (especially for credit unions and utilities) start ticking on confirmation, not on leak-site posting.

Hardening Recommendations

Immediate (24 hours)

Patch or mitigate the KEV edge exposures: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310). If patching isn't possible today, restrict management-plane access to known admin subnets.
Enforce MFA on all remote access — VPN, RDP gateways, OWA. Credential-based access is QILIN's most reliable door.
Block PsExec-style service execution for non-admin workstations via WDAC/AppLocker and alert on Event 7045 everywhere.
Alert on shadow copy deletion using the Sigma rule above; pair with automatic host isolation on the EDR.
Audit scheduled tasks and new local admins created in the last 14 days (script above).
Egress filtering: block or alert on bulk transfers to consumer cloud storage and unclassified destinations.

Short-term (2 weeks)

Segment backup infrastructure onto an isolated management network with immutable/offline copies and separate credentials.
Isolate vCenter/ESXi management behind a jump host with dedicated admin accounts; deploy detection for VM power-off storms.
Deploy deception: canary fileshares with tempting names (Finance, Backups) wired to high-severity alerts — staging behavior trips them reliably.
Tiered admin model enforcement to prevent domain admin credentials from touching workstations, breaking the lateral-movement chain affiliates depend on.
Tabletop the leak-site scenario: decide now who speaks, who approves, and what your posture is if your name appears on a leak site with unverified claims.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

QILIN Ransomware Gang: 16 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules