QILIN Ransomware Gang: 19 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: Potential Qilin Ransomware Initial Access via VPN Exploitation
id: 96c0a3a1-f4c2-4b92-8f7b-8b2b7d3a3d44
description: Detects potential exploitation of VPN vulnerabilities commonly used by Qilin for initial access
author: Security Arsenal
status: stable
date: 2026/06/13
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.initial_access
    - attack.t1190
    - detection.emerging_threats
logsource:
    product: firewall
    category: network
detection:
    selection:
        dest_port:
            - 443
            - 500
            - 4500
        protocol:
            - tcp
            - udp
    filter_standard:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter_known_good:
        user|contains:
            - 'service account'
            - 'legitimate vpn'
    condition: selection and not 1 of filter*
falsepositives:
    - Legitimate remote access from new locations
level: high
---
title: Qilin Ransomware Lateral Movement via PsExec and WMI
id: 7c4e1d6c-2e4b-4a8a-9d3a-1e7f5b4d6c8a
description: Detects lateral movement techniques commonly used by Qilin ransomware operators
author: Security Arsenal
status: stable
date: 2026/06/13
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 5145
        ShareName|contains: 'ADMIN$'
        RelativeTargetName|contains: 
            - 'PSEXESVC'
    selection_wmi:
        EventID: 4688
        NewProcessName|contains: 'wmiprvse.exe'
        CommandLine|contains: 
            - 'Invoke-CimMethod'
            - 'Invoke-WmiMethod'
    condition: 1 of selection*
falsepositives:
    - Legitimate administrative activities
level: high
---
title: Potential Qilin Ransomware Data Staging and Exfiltration
id: 8a5e2d7b-3f5c-4b9a-8e4b-2f8c6a5d7e9f
description: Detects potential data staging and exfiltration activities preceding Qilin ransomware deployment
author: Security Arsenal
status: stable
date: 2026/06/13
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.t1020
logsource:
    product: windows
    service: security
detection:
    selection_archiving:
        EventID: 4663
        ObjectName|contains: 
            - '.zip'
            - '.rar'
            - '.7z'
        AccessMask: '0x1'
    selection_rclone:
        EventID: 4688
        NewProcessName|contains: 'rclone.exe'
    selection_large_data_transfer:
        EventID: 5156
        DestPort: 
            - 443
            - 21
            - 22
    timeframe: 2h
    condition: 1 of selection*
falsepositives:
    - Legitimate data backup activities
    - Authorized large file transfers
level: medium

// Qilin Ransomware Pre-Encryption Activity Hunt
// This query looks for indicators of Qilin's pre-encryption activities
let timeRange = 7d;
let suspiciousProcesses = dynamic(["rclone.exe", "megacmd.exe", "psexec.exe", "procdump.exe", "mimikatz.exe"]);
let commonQilinTools = dynamic(["7z.exe", "winrar.exe", "powershell.exe", "cmd.exe", "wmi.exe"]);
// Hunt for unusual process execution patterns
DeviceProcessEvents
| where Timestamp > ago(timeRange)
| where FileName in~ (suspiciousProcesses) 
   or (FileName in~ (commonQilinTools) and ProcessCommandLine contains any("-enc", "-c", "-w", "hidden", "bypass"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
// Hunt for unusual network connections potentially related to data exfiltration
| union (DeviceNetworkEvents
| where Timestamp > ago(timeRange)
| where RemotePort in (443, 21, 22, 8443, 9443)
| where InitiatingProcessFileName in~ (suspiciousProcesses) or 
   (InitiatingProcessFileName in~ (commonQilinTools) and InitiatingProcessCommandLine contains any("upload", "sync", "copy"))
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine)
// Hunt for file access patterns consistent with data staging
| union (DeviceFileEvents
| where Timestamp > ago(timeRange)
| where FileName endswith_any(".zip", ".rar", ".7z", ".iso")
| where InitiatingProcessFileName in~ (commonQilinTools)
| project Timestamp, DeviceName, AccountName, FileName, ActionType, InitiatingProcessFileName)
| summarize count() by DeviceName, bin(Timestamp, 1h)
| where count_ > 5
| sort by count_ desc

<#
.Qilin Ransomware Response Check
.This script helps identify potential indicators of Qilin ransomware activity
.Usage: Run as Administrator on potentially compromised systems
#>

# Check for recently scheduled tasks (common persistence mechanism)
Write-Host "Checking for suspicious scheduled tasks created in the last 7 days..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($RecentTasks) {
    Write-Host "Found $($RecentTasks.Count) tasks created in the last 7 days:" -ForegroundColor Red
    $RecentTasks | ForEach-Object {
        Write-Host "Task: $($_.TaskName), Author: $($_.Author), Created: $($_.Date)" -ForegroundColor Red
    }
} else {
    Write-Host "No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# Check for unusual processes related to Qilin toolset
Write-Host "Checking for suspicious processes..." -ForegroundColor Yellow
$SuspiciousProcesses = @("rclone.exe", "megacmd.exe", "psexec.exe", "procdump.exe", "mimikatz.exe", "7z.exe", "winrar.exe")
$FoundProcesses = Get-Process | Where-Object { $SuspiciousProcesses -contains $_.ProcessName }
if ($FoundProcesses) {
    Write-Host "Found $($FoundProcesses.Count) suspicious processes:" -ForegroundColor Red
    $FoundProcesses | ForEach-Object {
        Write-Host "Process: $($_.ProcessName), ID: $($_.Id), Path: $($_.Path)" -ForegroundColor Red
    }
} else {
    Write-Host "No suspicious processes found." -ForegroundColor Green
}

# Check for recent modifications to Volume Shadow Copies
Write-Host "Checking for recent Volume Shadow Copy modifications..." -ForegroundColor Yellow
try {
    $ShadowCopies = Get-WmiObject -Class Win32_ShadowCopy | Where-Object { $_.InstallDate -gt (Get-Date).AddDays(-1) }
    if ($ShadowCopies) {
        Write-Host "Found $($ShadowCopies.Count) shadow copies modified in the last 24 hours:" -ForegroundColor Red
        $ShadowCopies | ForEach-Object {
            Write-Host "Volume: $($_.VolumeName), Created: $($_.InstallDate)" -ForegroundColor Red
        }
    } else {
        Write-Host "No recent shadow copy modifications found." -ForegroundColor Green
    }
} catch {
    Write-Host "Could not check shadow copies: $_" -ForegroundColor Yellow
}

# Check for unusual RDP connections
Write-Host "Checking for recent RDP connections..." -ForegroundColor Yellow
$RecentRDP = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match 'Logon Type:\s*10' }
if ($RecentRDP) {
    Write-Host "Found $($RecentRDP.Count) RDP logons in the last 24 hours:" -ForegroundColor Yellow
    $RecentRDP | ForEach-Object {
        if ($_.Message -match 'Account Name:\s*(\S+)') {
            $User = $Matches[1]
            if ($_.Message -match 'Source Network Address:\s*(\S+)') {
                $IP = $Matches[1]
                Write-Host "User: $User, IP: $IP" -ForegroundColor Yellow
            }
        }
    }
} else {
    Write-Host "No recent RDP connections found." -ForegroundColor Green
}

Write-Host "Qilin ransomware response check completed." -ForegroundColor Cyan