QILIN Ransomware Gang: 26 New Victims Posted in 100-Posting Window — APAC Expansion, Government Targeting & Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-08-12 | Source: Live monitoring of QILIN data leak site (.onion) via ransomware.live

Executive Summary

QILIN (aka Agenda) remains one of the most operationally consistent Ransomware-as-a-Service operations tracked on the dark web. In their last 100 leak site postings, 26 fresh victims were published — with 15 victims posted in just the last 72 hours, indicating an active mass-extortion wave rather than steady-state operations.

The most notable shift in this reporting window is geographic: QILIN is aggressively expanding into the Asia-Pacific theater (Taiwan, Japan, South Korea, Hong Kong, Thailand, Pakistan) while maintaining pressure on US-based manufacturing, professional services, and — critically — US municipal government (City of Winchester, published 2026-08-10). The annotation (critical data) appended to the HIGEN MOTOR victim listing signals an escalation in psychological pressure tactics designed to accelerate payment.

Security teams in government, energy & utilities, manufacturing, and transportation — particularly organizations with APAC operations or supply chain exposure — should treat this as an active campaign warning.

Threat Actor Profile — QILIN

Known Initial Access Methods

• Spear phishing with malicious attachments/links leading to loader deployment (Cobalt Strike, Sliver, custom loaders)
• Exploitation of internet-facing edge devices — VPN gateways, firewalls, and remote access software (see CVE section below)
• Compromised RDP credentials purchased from initial access brokers (IABs) on underground forums
• Abuse of remote monitoring & management (RMM) tooling — notably ConnectWise ScreenConnect, consistent with CVE-2024-1708 exploitation

Post-Compromise Playbook

QILIN affiliates routinely perform credential dumping (LSASS, NTDS.dit), lateral movement via PsExec/WMI/SMB, deployment of AnyDesk/Splashtop/ScreenConnect for persistence, and data staging to MEGA, Rclone, or attacker-controlled FTP before mass encryption. Their Rust-based encryptor supports command-line flags for targeted encryption, safe-mode execution, and VM targeting on ESXi hosts.

Current Campaign Analysis

Sector Targeting (This Window)

Geographic Concentration

• APAC (9 of 15 recent victims): TW (2), JP (1), KR (1), HK (1), TH (1), PK (1) — plus FI (1). This is a statistically significant APAC surge versus QILIN's historically US-centric victimology.
• United States (5 of 15): Manufacturing, professional services, technology, and municipal government.

Analyst note: APAC expansion likely reflects affiliate recruitment in the region and/or exploitation of less-mature EDR coverage and longer patching cycles on perimeter devices in those markets.

Victim Profile

Victims skew toward small-to-midsize enterprises (SMEs), estimated $5M–$250M annual revenue — the classic QILIN sweet spot: large enough to pay five-to-six figure ransoms, small enough to lack 24/7 SOC coverage and mature backup/DR programs. Outliers include municipal government (City of Winchester) and specialized industrial firms (HIGEN MOTOR — a motor/generator manufacturer with defense-industrial adjacency).

Posting Frequency & Escalation

• 15 postings in ~72 hours (Aug 9–11) — a burst pattern indicating either a coordinated affiliate push or batch-disclosure of victims who missed payment deadlines.
• The (critical data) tag on HIGEN MOTOR is a pressure escalation marker — QILIN uses annotated listings to signal sensitive IP/military-adjacent data and force negotiation.
• Expect a second wave of postings within 7–10 days as unresponsive victims from the current intrusion cohort hit their leak deadlines.

Initial Access Correlation — KEV CVEs

The following CISA KEV entries (confirmed ransomware use) align with QILIN's known edge-device exploitation tradecraft and should be treated as priority patch/verify items:

Action: If any of these products exist in your perimeter or management plane, verify patch status today and retro-hunt for exploitation indicators from the KEV publication dates forward.

Detection Engineering

The following analytics target QILIN's observed TTPs: edge/RMM-based initial access, LOLBin staging, credential dumping, lateral movement via PsExec/WMI, shadow copy deletion, and pre-encryption data staging.

---
title: QILIN Ransomware - Volume Shadow Copy Deletion via LOLBins
id: 8f2a1c3e-7b4d-4e5a-9c1f-qilin0000001
status: production
description: Detects deletion or resizing of Volume Shadow Copies using vssadmin, wmic, bcdedit, or PowerShell — a near-universal QILIN pre-encryption step executed shortly before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'Remove-WmiObject Win32_ShadowCopy'
      - 'Get-WmiObject Win32_Shadowcopy'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administrators performing shadow storage maintenance
  - Some backup software during reconfiguration
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: QILIN Ransomware - Remote Access Tool Installation and Execution
id: 8f2a1c3e-7b4d-4e5a-9c1f-qilin0000002
status: production
description: Detects installation or execution of RMM tools (ScreenConnect, AnyDesk, Splashtop, Atera) commonly deployed by QILIN affiliates for persistence and lateral access after initial compromise.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\screenconnect'
      - '\anydesk'
      - '\splashtop'
      - '\atera'
      - '\ninjarmm'
      - '\teamviewer'
  selection_cli:
    CommandLine|contains:
      - 'screenconnect'
      - 'anydesk'
      - 'splashtopstreamer'
      - '/i '
      - 'msiexec'
  filter_known_good:
    ParentImage|endswith:
      - '\sccm\ccmexec.exe'
      - '\intune\intunemanagementextension\agentexecutor.exe'
  condition: selection_img and selection_cli and not filter_known_good
falsepositives:
  - Managed service providers legitimately deploying RMM agents — baseline authorized tooling and alert on deviations
level: high
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.persistence
---
title: QILIN Ransomware - Lateral Movement via PsExec or WMI Process Execution
id: 8f2a1c3e-7b4d-4e5a-9c1f-qilin0000003
status: production
description: Detects remote service creation and WMI child process spawning consistent with QILIN affiliate lateral movement using PsExec-style service execution or WMIC remote process calls.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
logsource:
  product: windows
  category: process_creation
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_wmi_parent:
    ParentImage|endswith: '\wmiprvse.exe'
  selection_wmi_children:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\cscript.exe'
      - '\wscript.exe'
  condition: selection_psexec or (selection_wmi_parent and selection_wmi_children)
falsepositives:
  - Enterprise management tools (SCCM, PDQ) — whitelist authorized management hosts by source IP/account
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1047

Microsoft Sentinel KQL — Pre-Encryption Staging Hunt

Hunt for the QILIN kill chain sequence: suspicious RMM execution, mass file staging to archive utilities or cloud sync tools, and shadow copy tampering — correlated per device within a 48-hour window.

let TimeWindow = 7d;
let StagingTools = dynamic(["rclone.exe","megacmd.exe","7z.exe","rar.exe","winrar.exe","filezilla.exe","winscp.exe","curl.exe"];
let RMMTools = dynamic(["anydesk.exe","screenconnect","splashtopstreamer.exe","teamviewer.exe"]);
let ShadowDelete = dynamic(["delete shadows","resize shadowstorage","recoveryenabled no"]);
let RMM = DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where FileName has_any (RMMTools) or ProcessCommandLine has_any (RMMTools)
    | project DeviceName, RMMTime=TimeGenerated, RMMProcess=FileName, AccountName, InitiatingProcessRemoteSessionIP=RemoteIP;
let Staging = DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where FileName has_any (StagingTools)
    | where ProcessCommandLine has_any ("copy","sync","move","archive","a ","\\appdata\\","\\users\\")
    | project DeviceName, StageTime=TimeGenerated, StageProcess=FileName, StageCmd=ProcessCommandLine;
let Shadow = DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessCommandLine has_any (ShadowDelete)
    | project DeviceName, ShadowTime=TimeGenerated, ShadowCmd=ProcessCommandLine;
RMM
| join kind=inner (Staging) on DeviceName
| join kind=inner (Shadow) on DeviceName
| where StageTime between (RMMTime .. RMMTime + 48h) and ShadowTime between (StageTime .. StageTime + 24h)
| project DeviceName, AccountName, RMMTime, RMMProcess, StageTime, StageProcess, StageCmd, ShadowTime, ShadowCmd, InitiatingProcessRemoteSessionIP
| sort by ShadowTime desc;

Analyst guidance: Any device matching the full RMM → staging → shadow-deletion sequence within the correlation window should be treated as an imminent encryption event and isolated immediately. Partial matches (2 of 3) warrant same-day triage.

Rapid Response PowerShell — Perimeter & Staging Triage

Run on suspect hosts or via remote execution across the fleet to surface exposed RDP, recent scheduled-task persistence, and shadow copy tampering:

# Security Arsenal - QILIN Rapid Triage Script (run elevated)
$Report = @{}

# 1. RDP exposure check
$Report.RDPEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$Report.RDPNLA = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication

# 2. Scheduled tasks created in last 7 days (QILIN persistence vector)
$Report.NewTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute + ' ' + $_.Actions.Arguments}}

# 3. Shadow copy status — empty result after known-good backups = tampering indicator
$Report.ShadowCopies = @(Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue).Count
$Report.VSSEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7040; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'VSS|Volume Shadow'} | Select-Object TimeCreated, Id, Message -First 20

# 4. Recent suspicious process artifacts (RMM + archivers + cobalt strike defaults)
$Report.SuspiciousArtifacts = Get-ChildItem 'C:\Users\*\AppData\Roaming','C:\ProgramData' -Recurse -Depth 2 -ErrorAction SilentlyContinue |
    Where-Object {$_.Name -match 'anydesk|screenconnect|splashtop|rclone|7z\.exe|beacon|artifact'} |
    Select-Object FullName, CreationTime -First 50

# 5. Recent LSASS access events (if Sysmon deployed - Event ID 10)
$Report.LSASSAccess = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'lsass.exe'} | Select-Object TimeCreated, Message -First 20

$Report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\qilin_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage complete. Output: $env:TEMP\qilin_triage_$(hostname)_*.json" -ForegroundColor Green

Incident Response Priorities — QILIN Playbook

T-Minus Detection Checklist (Before Encryption Fires)

• New RMM tooling (AnyDesk/ScreenConnect/Splashtop) on hosts that never had it — isolate the host, do not just uninstall
• Bulk 7z/RAR archive creation in user directories, ProgramData, or staging folders (C:\temp, C:\Windows\Temp subfolders)
• rclone, megacmd, or large outbound transfers to MEGA.io, file.io, or unknown FTP/cloud endpoints (check egress proxy and NetFlow for multi-GB single-host transfers)
• VSS deletion events, bcdedit recoveryenabled no, or backup console tampering/disabling
• NTDS.dit access (Event 4663 on domain controllers), LSASS access (Sysmon 10), DCSync-style replication requests
• New local admin accounts or unexpected additions to Domain Admins in the preceding 14 days
• SMB write patterns consistent with PsExec service binaries (ADMIN$ writes of ~35KB executables) across multiple hosts in sequence

Assets QILIN Prioritizes for Exfiltration

• Finance/accounting data, HR records, payroll, PII (leverage for victim and third-party pressure)
• Contracts, legal documents, insurance policies (used to calibrate ransom demand vs. coverage)
• Engineering/IP data — CAD files, schematics, manufacturing process docs (note the HIGEN MOTOR (critical data) tag — industrial IP is being actively weaponized in this campaign)
• Email archives from Exchange (justifying CVE-2023-21529 verification)
• Domain controller NTDS.dit and credential stores

Containment Actions — Ordered by Urgency

1. Isolate, don't power off confirmed-staging hosts (preserve memory for forensic capture; encryption may already be armed)
2. Disable compromised accounts enterprise-wide — assume tier-0 credential compromise if lateral movement observed; force reset on privileged accounts and krbtgt (twice) if DC access suspected
3. Block RMM tooling at the perimeter and EDR policy level — any tool not in your authorized software inventory
4. Block known exfil destinations (MEGA, anonfile-type services, Rclone cloud endpoints) at the egress proxy immediately
5. Segment backup infrastructure — verify backup console/admin credentials are isolated from AD; confirm offline/immutable copies exist before declaring safe
6. Snapshot-check all critical servers — enumerate remaining shadow copies to determine if pre-deletion recovery points survive
7. Engage IR retainer and legal/comms counsel early — QILIN leak deadlines typically allow only 5–10 days before publication

Hardening Recommendations

Immediate (24 Hours)

1. Patch/verify the five KEV CVEs — Check Point Security Gateway (CVE-2026-50751), Cisco FMC (CVE-2026-20131), ScreenConnect (CVE-2024-1708), Exchange (CVE-2023-21529), Nx Console (CVE-2026-48027). These are confirmed ransomware-used and map directly to QILIN's access vectors.
2. Audit all RMM software against an authorized whitelist; remove or block anything unapproved. QILIN affiliates live off RMM tooling for persistence.
3. Enforce MFA on all remote access — VPN, RDP gateways, and especially any legacy IKEv1-aggressive-mode Check Point configurations.
4. Disable RDP from the internet entirely; require VPN + MFA + conditional access. Run the triage script above fleet-wide.
5. Deploy the Sigma rules and KQL hunt in this briefing; alert on any full-sequence match as a P1.
6. Verify backup immutability and test one restore — QILIN actively targets backup infrastructure before detonation.

Short-Term (2 Weeks)

1. Network segmentation between IT and OT — manufacturing victims dominate this campaign; flat networks are QILIN's lateral-movement enabler. Isolate CNC/industrial control segments with deny-by-default east-west rules.
2. Implement application control (WDAC/AppLocker) blocking unsigned executables in user-writable paths and unauthorized archivers/sync tools.
3. Deploy egress data-loss detection — alert on sustained multi-GB outbound flows from servers/workstations to non-business destinations.
4. Tiered admin model with PAWs — eliminate standing Domain Admin usage on workstations and servers; QILIN's speed depends on harvested DA credentials.
5. APAC-region security uplift — if you operate in TW/JP/KR/HK/TH/PK/MX, assume elevated targeting; extend EDR coverage and 24/7 monitoring to regional endpoints and verify regional patch compliance on perimeter devices.
6. Tabletop the extortion scenario — QILIN's double-extortion model means "we have backups" is not a response plan. Pre-stage legal, comms, and negotiation-support decision trees.

This briefing is based on live dark web leak site monitoring. Victim listings represent attacker claims; inclusion does not confirm breach details. Security Arsenal tracks QILIN and 150+ ransomware operations continuously.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub