QILIN Ransomware Gang: 17 New Victims Posted — Global Campaign Targeting Financial & Construction Sectors

---
title: QILIN Ransomware Initial Access via VPN Vulnerabilities
id: 9a8f4e2d-1c3b-4a5e-8b6d-7c9e0f1a2b3c
description: Detects potential QILIN ransomware initial access through exploitation of VPN vulnerabilities including Check Point Security Gateway and Cisco Firewall Management Center
author: Security Arsenal
date: 2026/06/24
status: stable
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: firewall
detection:
    selection:
        - dst_port: 443
        - protocol: 'IKEv1'
        - status: 'failed'
        - msg|contains: 
            - 'authentication failure'
            - 'invalid user'
    condition: selection
falsepositives:
    - Legitimate misconfigurations
    - Failed legitimate access attempts
level: high
---
title: QILIN Ransomware Lateral Movement via PsExec
id: 8a7e3d1c-2b4a-59e6-9c7d-8b0f1a2b3c4d
description: Detects potential QILIN ransomware lateral movement using PsExec across network shares
author: Security Arsenal
date: 2026/06/24
status: stable
references:
    - https://attack.mitre.org/techniques/T1021/002/
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 
            - 'ADMIN$'
            - 'IPC$'
        SubjectUserName|contains:
            - 'ADMIN'
            - 'SYSTEM'
    filter:
        SubjectLogonId: '0x3e7'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative activities
    - System management tools
level: medium
---
title: QILIN Ransomware Data Staging Prior to Encryption
id: 7c6d2b1a-3958-48f5-7b0c-9a1e2f3d4c5e
description: Detects potential QILIN ransomware data staging patterns observed before encryption including mass file operations and archive creation
author: Security Arsenal
date: 2026/06/24
status: stable
references:
    - https://attack.mitre.org/techniques/T1074/
tags:
    - attack.collection
    - attack.t1074
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11  # File creation
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        TargetFilename|contains:
            - '\Temp\'
            - '\AppData\Local\'
        TargetFilename|endswith:
            - '.zip'
            - '.rar'
            - '.7z'
    condition: selection | count(TargetFilename) > 10
timeframe: 5m
falsepositives:
    - Legitimate backup operations
    - User file compression activities
level: high

// Hunt for QILIN ransomware lateral movement indicators
// Search for unusual SMB access patterns, PsExec execution, and WMI commands
union SecurityEvent, WindowsEvent
| where TimeGenerated > ago(7d)
| where 
    // Potential PsExec or WMI lateral movement
    (EventID == 5145 and ShareName in ('ADMIN$', 'IPC$') and RelativeTargetName contains 'PSEXESVC') or
    (EventID == 4688 and ProcessName contains 'psexec') or
    (EventID == 4688 and CommandLine contains 'wmic' and CommandLine contains 'node:') or
    // Potential Cobalt Strike beacon activity
    (EventID == 4688 and ProcessName contains 'powershell' and CommandLine contains 'DownloadString') or
    (EventID == 4688 and ProcessName contains 'rundll32' and CommandLine contains 'javascript:')
| summarize 
    count() by 
    Computer, 
    Account, 
    ProcessName, 
    EventID, 
    bin(TimeGenerated, 1h)
| where count_ > 5  // Threshold for suspicious activity
| sort by count_ desc

# QILIN Ransomware Rapid Response Assessment Script
# Author: Security Arsenal
# Purpose: Check for indicators of QILIN ransomware activity

Write-Host "=== QILIN Ransomware Assessment Script ===" -ForegroundColor Cyan
Write-Host "Scanning for potential QILIN ransomware indicators..." -ForegroundColor Yellow
Write-Host ""

# Check for unusual scheduled tasks created in the last 7 days
Write-Host "Checking for recently created scheduled tasks..." -ForegroundColor Yellow
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($recentTasks) {
    Write-Host "[$(Get-Date)] Found $($recentTasks.Count) recently created scheduled tasks:" -ForegroundColor Red
    $recentTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[$(Get-Date)] No suspicious scheduled tasks found." -ForegroundColor Green
}

# Check for modifications to Volume Shadow Copies in the last 7 days
Write-Host "`nChecking for modifications to Volume Shadow Copies..." -ForegroundColor Yellow
$vssChanges = vssadmin list shadows | Select-String "Shadow Copy Volume Creation Time"
if ($vssChanges) {
    $recentShadows = $vssChanges | Where-Object { 
        $_.ToString() -match "Creation Time: (\d{2}/\d{2}/\d{4})" -and 
        [DateTime]::ParseExact($matches[1], 'MM/dd/yyyy', $null) -gt (Get-Date).AddDays(-7)
    }
    if ($recentShadows) {
        Write-Host "[$(Get-Date)] Found recent modifications to Volume Shadow Copies:" -ForegroundColor Red
        $recentShadows | ForEach-Object { Write-Host $_.ToString() }
    } else {
        Write-Host "[$(Get-Date)] No suspicious VSS changes found." -ForegroundColor Green
    }
}

# Check for open RDP connections
Write-Host "`nChecking for active RDP connections..." -ForegroundColor Yellow
$rdpSessions = qwinsta | Select-String "rdp-tcp"
if ($rdpSessions) {
    Write-Host "[$(Get-Date)] Found active RDP sessions:" -ForegroundColor Red
    $rdpSessions | ForEach-Object { Write-Host $_.ToString() }
} else {
    Write-Host "[$(Get-Date)] No active RDP sessions found." -ForegroundColor Green
}

# Check for recent service installations
Write-Host "`nChecking for recently installed services..." -ForegroundColor Yellow
$recentServices = Get-WmiObject Win32_Service | Where-Object { 
    $_.InstallDate -and 
    [DateTime]::ParseExact($_.InstallDate.SubString(0,8), 'yyyyMMdd', $null) -gt (Get-Date).AddDays(-7)
}
if ($recentServices) {
    Write-Host "[$(Get-Date)] Found $($recentServices.Count) recently installed services:" -ForegroundColor Red
    $recentServices | Select-Object Name, DisplayName, State, InstallDate | Format-Table
} else {
    Write-Host "[$(Get-Date)] No suspicious service installations found." -ForegroundColor Green
}

# Check for common QILIN file extensions
Write-Host "`nChecking for files with suspicious extensions..." -ForegroundColor Yellow
$suspiciousExtensions = @('.qilin', '.encrypted', '.locked', '.crypt')
$foundFiles = @()
foreach ($ext in $suspiciousExtensions) {
    $files = Get-ChildItem -Path C:\ -Filter "*$ext" -Recurse -ErrorAction SilentlyContinue
    if ($files) {
        $foundFiles += $files
    }
}
if ($foundFiles) {
    Write-Host "[$(Get-Date)] Found $($foundFiles.Count) files with suspicious extensions:" -ForegroundColor Red
    $foundFiles | Select-Object FullName, LastWriteTime | Format-Table
} else {
    Write-Host "[$(Get-Date)] No files with suspicious extensions found." -ForegroundColor Green
}

Write-Host "`n=== Assessment Complete ===" -ForegroundColor Cyan
Write-Host "If any RED indicators were found, initiate your incident response procedures immediately." -ForegroundColor Yellow