QILIN Ransomware Gang: 19 Victims Posted in 72 Hours — Manufacturing & Agri-Food Surge, Detection Rules Inside

Classification: TLP:CLEAR | Publication Date: 2026-09-17 | Source: Live .onion leak site monitoring via ransomware.live, CISA KEV cross-reference

Executive Summary

Security Arsenal's dark web monitoring has confirmed a significant escalation in QILIN ransomware operations. In the last 72 hours (2026-09-14 through 2026-09-16), the group posted 15 victims in a single burst, part of 19 postings within its most recent 100-leak window. The campaign shows a clear operational focus on manufacturing and industrial-adjacent organizations (6 of 15 recent victims), with a notable strike against the agriculture and food production sector — a vertical with notoriously low tolerance for operational downtime and historically high ransom-payment rates.

Geographically, the campaign spans eight countries with the United States absorbing the plurality of victims (6 of 15), followed by Australia (2) and a broad European spread (SE, FR, ES, IT). This is consistent with QILIN's established pattern of opportunistic-but-industrialized victimology: wide geographic net, sector concentration where extortion leverage is highest.

Bottom line: If you operate in manufacturing, food/agriculture, civil engineering/construction, legal services, or transportation — and you have VMware vCenter, Cisco FMC, Check Point gateways, or ConnectWise ScreenConnect anywhere in your estate — treat this as an active threat against your organization, not an abstract one.

Threat Actor Profile — QILIN

QILIN's affiliate model means TTP variance is high at the intrusion edge but converges at the staging and detonation phase — which is exactly where defenders should concentrate detection engineering.

Current Campaign Analysis

Sector Targeting (last 15 postings)

The manufacturing skew is deliberate and financially rational: industrial firms face existential pressure from production-line downtime, frequently run legacy OT-adjacent Windows estates with flat networks, and often hold sensitive IP (CAD files, process documentation, contracts) that amplifies extortion leverage. The inclusion of a major agriculture/food production name (listed on the leak site as "ADM") signals the group is comfortable hitting critical-adjacent infrastructure — organizations in that vertical should note the elevated risk and the likelihood of regulatory scrutiny following any incident.

Note: victim names are as published on the criminal leak site. Leak-site claims are not independently verified confirmations of compromise; listed organizations may contest or deny the postings.

Geographic Concentration

• US (6): manufacturing, legal, agriculture, transportation — broad enterprise targeting
• Australia (2): commercial and nonprofit sectors — consistent with QILIN's recurring AU pressure
• Europe (4): Sweden, France, Spain, Italy — heavy civil engineering and manufacturing (Aarsleff, Thema Foundries, Taurus Ibérica)
• Canada (1), Argentina (1)

Victim Profile

The victim set spans mid-market to large enterprise: national civil-engineering and foundry operations, multi-office law firms, and large food-production entities. Estimated revenue range roughly $10M–$1B+, with a center of gravity in the $50M–$500M mid-market band — the classic RaaS sweet spot where organizations are large enough to pay but frequently under-resourced in security operations.

Posting Frequency & Escalation

15 postings in ~72 hours (2026-09-14 → 2026-09-16) represents a burst pattern rather than steady drip — typical of affiliates batch-publishing victims after negotiation windows expire simultaneously. Expect a second wave of postings from the same intrusion cohort in the coming 7–14 days.

CVE Correlation — Probable Initial Access Vectors

QILIN affiliates are documented exploiters of edge and management-plane vulnerabilities. The following CISA KEV entries — all confirmed for ransomware use — map directly onto the access methods consistent with this campaign:

Assessment: Organizations with unpatched vCenter, Check Point gateways, or ScreenConnect instances should treat themselves as pre-compromised and begin hunting immediately. The vCenter CVE is the most dangerous pairing with QILIN's ESXi encryptor.

Detection Engineering

The following detections target QILIN's convergent TTPs: edge/VPN exploitation, suspicious logon patterns, pre-encryption staging (shadow copy deletion, backup tampering), lateral movement via PsExec/WMI, and exfiltration tooling.

---
title: QILIN Ransomware - Volume Shadow Copy Deletion Pre-Encryption
description: Detects deletion or manipulation of Volume Shadow Copies via vssadmin, wmic, or diskshadow — a hallmark QILIN pre-detonation step observed across affiliate intrusions
status: experimental
date: 2026/09/17
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\diskshadow.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'resize shadowstorage'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare on endpoints; investigate any occurrence on servers hosting file shares or hypervisors)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: QILIN Ransomware - PsExec and WMI Lateral Movement Execution
description: Detects remote service execution patterns consistent with QILIN affiliate lateral movement — PsExec-style service creation and WMI remote process spawn from parent wmiprvse
status: experimental
date: 2026/09/17
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
      - '\csexec.exe'
  selection_wmi_child:
    ParentImage|endswith: '\wmiprvse.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling (SCCM, remote management platforms); baseline admin workstation sources and alert on deviation
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
---
title: QILIN Ransomware - Data Staging and Exfiltration Tooling
description: Detects execution of Rclone and common exfiltration/archiving tooling abused by QILIN affiliates for pre-encryption data theft
status: experimental
date: 2026/09/17
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\7z.exe'
      - '\rar.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'mega.nz'
      - 'a -m'
      - '-v'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate cloud sync operations; alert severity should escalate sharply if the parent process is non-standard or the host is a server
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection
  - attack.t1560.001

The following Sentinel hunt query stitches together QILIN's pre-ransomware staging sequence: suspicious logons from remote access infrastructure followed by shadow-copy tampering or mass file access within a 6-hour window.

// QILIN Pre-Ransomware Staging Hunt — correlate remote-access logons with destructive/staging behaviors
let lookback = 7d;
let stagingWindow = 6h;
let SuspiciousLogons =
    DeviceLogonEvents
    | where Timestamp > ago(lookback)
    | where LogonType in ("RemoteInteractive", "Network")
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
    | summarize FirstLogon=min(Timestamp), LogonCount=count() by DeviceName, AccountName, RemoteIP
    | where LogonCount >= 5 or FirstLogon > ago(2d); // brute-force volume or novel external source
let StagingEvents =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled",
                                        "ignoreallfailures", "wbadmin delete", "rclone",
                                        "psexesvc", "wevtutil cl")
    | project StagingTime=Timestamp, DeviceName, StagingProcess=FileName,
              StagingCmd=ProcessCommandLine, InitiatingAccount=AccountName;
SuspiciousLogons
| join kind=inner StagingEvents on DeviceName
| where StagingTime between (FirstLogon .. FirstLogon + stagingWindow)
| project DeviceName, AccountName, RemoteIP, FirstLogon, LogonCount,
          StagingTime, StagingProcess, StagingCmd
| order by StagingTime asc;

The following PowerShell script provides rapid triage: exposed RDP listeners, scheduled tasks created in the last 7 days, shadow copy status, and recently created suspicious services — run elevated on suspect hosts or at scale via your EDR/remote shell.

# QILIN Rapid Triage Script — run elevated. Outputs to C:\Temp\qilin_triage_<hostname>_<timestamp>.txt
$ErrorActionPreference = 'SilentlyContinue'
$out = "C:\Temp\qilin_triage_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
New-Item -Path C:\Temp -ItemType Directory -Force | Out-Null
"=== QILIN Rapid Triage — $(Get-Date) on $env:COMPUTERNAME ===" | Out-File $out

"`n[1] RDP Listener & Exposure" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Enabled (0=enabled): $($rdp.fDenyTSConnections)" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen | Format-Table | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Established |
    Select-Object LocalAddress, RemoteAddress, OwningProcess | Format-Table | Out-File $out -Append

"`n[2] Scheduled Tasks Created in Last 7 Days" | Out-File $out -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} |
    Format-List | Out-File $out -Append

"`n[3] Volume Shadow Copy Status (QILIN deletes these pre-encryption)" | Out-File $out -Append
$shadows = Get-CimInstance Win32_ShadowCopy
if (-not $shadows) { "WARNING: No shadow copies exist — verify against backup baseline!" | Out-File $out -Append }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table | Out-File $out -Append }
"`nvssadmin deletion events (System log, last 7d):" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=(Get-Date).AddDays(-7)} |
    Where-Object {$_.Message -match 'shadow'} | Format-List TimeCreated, Message | Out-File $out -Append

"`n[4] Services Created in Last 7 Days (PsExec-class persistence)" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} |
    Select-Object TimeCreated, Message | Format-List | Out-File $out -Append

"`n[5] Suspicious Process Artifacts (rclone, psexec, mass-archive tooling)" | Out-File $out -Append
Get-ChildItem -Path C:\Users,C:\ProgramData,C:\Windows\Temp -Recurse -Include rclone.exe,psexec*.exe,paexec.exe,rar.exe -Depth 4 |
    Select-Object FullName, CreationTime | Format-Table | Out-File $out -Append

"`n[6] Recent vCenter/Edge Indicator Note" | Out-File $out -Append
"If this host is vCenter-adjacent: verify CVE-2026-59310 patch state and review vpxd logs for traversal attempts." | Out-File $out -Append

Write-Host "Triage complete: $out"

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

QILIN intrusions typically present a detectable window between initial access and detonation. Hunt for, in order:

1. Edge device anomalies — new/unknown admin sessions on VPN gateways, FMC, or Check Point management interfaces; config exports from network appliances
2. Credential dumping artifacts — LSASS access by non-standard processes, ntds.dit access or shadow copies of the System hive on DCs
3. Discovery bursts — net group "Domain Admins", nltest, arp -a, mass SMB enumeration from a single host
4. Staging indicators — Rclone/7zip execution, large archive creation on file servers, MEGA/cloud-storage destination traffic
5. Pre-detonation sabotage — VSS deletion, bcdedit recovery disabling, backup-agent service termination, event log clearing (wevtutil cl), AV/EDR tampering
6. Encryptor deployment — PsExec service creation fanning out from one host, GPO modification events, ESXi shell enablement on hypervisors

Critical Assets QILIN Prioritizes for Exfiltration

Based on historical victimology and this campaign's sector mix, expect targeting of:

• File servers & NAS — contracts, CAD/engineering drawings, financials (especially acute for the manufacturing/foundry victims in this wave)
• Email archives — negotiation leverage and PII
• HR & payroll data — identity-theft leverage for double extortion
• Backup infrastructure — targeted for destruction, not theft; protect Veeam/backup consoles as Tier-0
• vCenter/ESXi — mass encryption multiplier; if vCenter is compromised, assume all datastores are at risk

Containment Actions — Ordered by Urgency

1. Isolate affected segments immediately — disable switch ports / ACL the host, do not wait for confirmation of encryption
2. Kill edge access — force-disable compromised VPN accounts, revoke sessions, take the exploited gateway/FMC/ScreenConnect instance offline
3. Protect identity — reset KRBTGT (twice), all Domain Admin and service account credentials; invalidate all tokens
4. Preserve hypervisors — disable ESXi shell/SSH, isolate vCenter management network, snapshot nothing (snapshots are deleted by attackers anyway — rely on offline backups)
5. Verify backup integrity offline — assume online backups are targeted; confirm an isolated/offline copy exists before any recovery decision
6. Engage IR counsel early — leak-site publication means legal, regulatory (esp. food/ag critical infrastructure and AU/EU notification regimes), and communications obligations are already running

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV stack: CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), CVE-2024-1708 (ScreenConnect). If patching isn't possible in 24h, take the management interfaces off any internet-reachable path
• Disable ScreenConnect/RMM tooling not explicitly required; inventory all remote access software — QILIN affiliates ride whatever RMM they find
• Enforce phishing-resistant MFA (FIDO2) on all VPN, gateway, and management-plane access; audit for legacy IKEv1 and hard-coded credential exposure
• Deploy the Sigma rules above and run the KQL hunt retroactively over 14 days
• Verify one offline/immutable backup copy of Tier-0 assets (DCs, file servers, vCenter, backup catalog) — test a restore, don't just check a green dashboard
• Block egress to known exfil destinations (MEGA, unapproved cloud storage) and alert on Rclone signatures at the proxy

Short-Term (2 Weeks)

• Segment the virtualization plane: vCenter and ESXi management interfaces on a dedicated, jump-host-gated network with no direct user-subnet or internet reachability
• Tier-0 identity architecture: dedicated Privileged Access Workstations for domain/hypervisor administration; no DA credentials on endpoints
• OT/manufacturing segmentation: given this campaign's manufacturing skew, enforce Purdue-model separation between production networks and corporate IT; one-way flows where feasible
• Deploy canary artifacts: honey credentials, decoy file shares with alerting on access — cheap, high-fidelity early warning for staging behavior
• EDR tamper protection audit: ensure sensor isolation, and alert on any attempt to stop security services (a QILIN pre-detonation constant)
• Threat-informed tabletop: run a QILIN-scenario exercise covering the leak-site/negotiation decision tree — legal, comms, and executive stakeholders included

Security Arsenal continues to monitor QILIN's leak infrastructure. Subscribers to AlertMonitor receive real-time victim-posting alerts and updated detection content as this campaign evolves.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub