QILIN Ransomware Gang: 18 New Victims Posted — Business Services Targeted & Detection Engineering

---
title: Potential QILIN Ransomware Initial Access via VPN Exploitation
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential QILIN ransomware initial access attempts through VPN exploitation patterns observed in recent campaigns
status: experimental
date: 2026/06/14
author: Security Arsenal Threat Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1133
    - qilin
logsource:
    category: firewall
detection:
    selection:
        dst_port:
            - 443
            - 500
            - 4500
        protocol:
            - udp
            - tcp
    filter_likely_legit:
        src_ip:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_likely_legit
falsepositives:
    - Legitimate remote access from unknown IPs
level: medium
---
title: Potential QILIN Lateral Movement via PsExec and WMI
id: b2c3d4e5-6789-01ab-cdef-234567890abc
description: Detects potential QILIN ransomware lateral movement patterns using PsExec and WMI, commonly used in their campaigns
status: experimental
date: 2026/06/14
author: Security Arsenal Threat Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - qilin
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 5145
        ShareName: 'ADMIN$'
        RelativeTargetName|endswith: 'psexesvc.exe'
    selection_wmi:
        EventID: 4688
        NewProcessName|contains:
            - 'wmiprvse.exe'
            - 'svchost.exe'
        CommandLine|contains:
            - 'wmic'
            - 'Invoke-WmiMethod'
            - 'Get-WmiObject'
    filter_legit_admin:
        SubjectUserName|contains:
            - 'admin'
            - 'service'
            - 'system'
    condition: 1 of selection_* and not filter_legit_admin
falsepositives:
    - Legitimate administrative activities
    - IT management tools
level: high
---
title: Potential QILIN Data Staging Before Encryption
id: c3d4e5f6-7890-12ab-def0-345678901234
description: Detects potential QILIN data staging patterns observed in recent campaigns prior to encryption
status: experimental
date: 2026/06/14
author: Security Arsenal Threat Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.exfiltration
    - attack.t1074.001
    - attack.t1048.003
    - qilin
logsource:
    product: windows
    service: sysmon
detection:
    selection_archive:
        EventID: 1
        Image|endswith:
            - '\winrar.exe'
            - '\7z.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - '-a'
            - 'Compress-Archive'
            - 'New-Item -ItemType File'
    selection_rclone:
        EventID: 1
        Image|endswith:
            - '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'config'
    selection_file_count:
        EventID: 1
        Image|endswith:
            - '\robocopy.exe'
        CommandLine|contains:
            - '/E'
            - '/COPYALL'
            - '/ZB'
    filter_legit:
        User|contains:
            - 'admin'
            - 'backup'
            - 'system'
    condition: 1 of selection_* and not filter_legit
falsepositives:
    - Legitimate backup operations
    - File archiving activities
level: high

// Hunt for QILIN lateral movement and staging indicators
let TimeFrame = ago(7d);
let SuspiciousProcesses = datatable(ProcessName:string, CommandLinePattern:string)[
    'psexec.exe', '-accepteula',
    'wmiprvse.exe', 'wmic process call',
    'rclone.exe', 'config',
    '7z.exe', '-tzip',
    'powershell.exe', 'Compress-Archive',
    'robocopy.exe', '/COPYALL'
];
DeviceProcessEvents
| where Timestamp >= TimeFrame
| where ProcessName in (SuspiciousProcesses)
| extend Matches = pack_all()
| where CommandLine has CommandLinePattern
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, InitiatingProcessFileName
| order by Timestamp desc

# QILIN Ransomware Rapid Response Hardening Script
# Run with elevated privileges

# Function to check for exposed RDP
function Test-RDPExposure {
    Write-Host "Checking for RDP exposure..." -ForegroundColor Yellow
    $rdpStatus = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
    $rdpNLA = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
    
    if ($rdpStatus -eq 0) {
        Write-Host "[CRITICAL] RDP is enabled on this system!" -ForegroundColor Red
    } else {
        Write-Host "[INFO] RDP is disabled on this system." -ForegroundColor Green
    }
    
    if ($rdpNLA -eq 0) {
        Write-Host "[CRITICAL] Network Level Authentication is not configured for RDP!" -ForegroundColor Red
    } else {
        Write-Host "[INFO] Network Level Authentication is configured for RDP." -ForegroundColor Green
    }
}

# Function to enumerate recently scheduled tasks
function Get-RecentScheduledTasks {
    Write-Host "Checking for scheduled tasks created in the last 7 days..." -ForegroundColor Yellow
    $dateThreshold = (Get-Date).AddDays(-7)
    
    Get-ScheduledTask | Where-Object {
        $_.Date -gt $dateThreshold -and $_.Author -notmatch "Microsoft|System"
    } | ForEach-Object {
        Write-Host "[SUSPICIOUS] Task found: $($_.TaskName), Author: $($_.Author), Created: $($_.Date)" -ForegroundColor Red
        Get-ScheduledTaskInfo -TaskName $_.TaskName | Format-List
    }
}

# Function to check for recently modified Volume Shadow Copies
function Test-RecentShadowCopies {
    Write-Host "Checking for recently modified Volume Shadow Copies..." -ForegroundColor Yellow
    $dateThreshold = (Get-Date).AddHours(-24)
    
    Get-CimInstance Win32_ShadowCopy | Where-Object {
        $_.InstallDate -gt $dateThreshold
    } | ForEach-Object {
        Write-Host "[SUSPICIOUS] Recent shadow copy found: $($_.ID), Created: $($_.InstallDate), Volume: $($_.VolumeName)" -ForegroundColor Red
    }
}

# Function to check for evidence of data exfiltration tools
function Test-ExfiltrationTools {
    Write-Host "Checking for common data exfiltration tools..." -ForegroundColor Yellow
    $exfilTools = @('rclone.exe', 'winscp.exe', 'filezilla.exe', 'curl.exe')
    
    foreach ($tool in $exfilTools) {
        $paths = @(
            "C:\Windows\System32\$tool",
            "C:\Windows\SysWOW64\$tool",
            "C:\Program Files\$tool",
            "C:\Program Files (x86)\$tool",
            "$env:USERPROFILE\Downloads\$tool",
            "$env:TEMP\$tool"
        )
        
        foreach ($path in $paths) {
            if (Test-Path $path) {
                $fileInfo = Get-Item $path
                Write-Host "[SUSPICIOUS] Exfiltration tool found: $path, LastModified: $($fileInfo.LastWriteTime)" -ForegroundColor Red
            }
        }
    }
}

# Main execution
Write-Host "QILIN Ransomware Rapid Response Hardening Script" -ForegroundColor Cyan
Write-Host "=============================================" -ForegroundColor Cyan
Write-Host ""

Test-RDPExposure
Write-Host ""
Get-RecentScheduledTasks
Write-Host ""
Test-RecentShadowCopies
Write-Host ""
Test-ExfiltrationTools

Write-Host ""
Write-Host "Script execution completed." -ForegroundColor Cyan