QILIN Ransomware Gang: 28 New Victims Posted in 24 Hours — Cross-Sector Campaign Analysis, Initial Access CVEs & Detection Rules

Classification: TLP:CLEAR | Brief Date: 2026-08-17 | Source: Direct .onion leak site monitoring via ransomware.live

Executive Summary

Dark web monitoring of QILIN's Tor-based leak site confirms a sharp escalation in operations. Of the group's last 100 postings, 28 victims were published in the most recent cycle, and 15 organizations were posted in a single 24-hour window on 2026-08-16 — an unusually dense publication burst indicating either a mass-exploitation event or a deliberate pressure campaign timed to maximize media impact.

Sector coverage is broad but heavily weighted toward Manufacturing (4 victims in 24h), Technology (3), Education (2), and Financial Services (1), with geographic reach spanning the US, Chile, Italy, Canada, Germany, the Philippines, Malaysia, and Japan. This is a global, opportunistic campaign with clear preference for mid-market organizations with weak VPN/remote-access posture and under-monitored backup infrastructure.

Security teams running Check Point Security Gateway, ConnectWise ScreenConnect, or Microsoft Exchange should treat this as an active-exploitation alert: all three appear on the CISA KEV with confirmed ransomware use and align with QILIN's documented initial access tradecraft.

Threat Actor Profile — QILIN

Key tradecraft note: QILIN affiliates are aggressive about Volume Shadow Copy deletion and backup-target encryption — they hunt Veeam repositories and domain-joined backup servers before detonation. Their Rust encryptor supports safe-mode execution and can be deployed via GPO after domain admin compromise.

Current Campaign Analysis

Sector Targeting (Last 100 Postings)

Geographic Concentration

• Primary: United States (consistent with affiliate monetization preference)
• Secondary: Italy — 4 of 15 same-day victims (Coface, Mulino Padano, Loescher, Zanichelli) — this clustering strongly suggests a dedicated Italian-speaking affiliate or a single exploited vector common to Italian mid-market IT providers (watch MSP/RMM compromise as the upstream source)
• Expansion: APAC (PH, MY, JP) and LATAM (CL) — new-market affiliate recruitment paying off

Victim Profile

The victim mix skews mid-market (est. $10M–$500M revenue, 100–2,500 employees) — large enough to pay six-to-seven figures, small enough to lack 24/7 SOC coverage. The law firm and financial services inclusions show QILIN continues cherry-picking high-sensitivity-data organizations within otherwise opportunistic waves.

Posting Frequency / Escalation

15 same-day postings is well above QILIN's baseline of 2–4/day. Two interpretations, both actionable:

1. Mass exploitation event — likely tied to the Check Point CVE-2026-50751 campaign (KEV-listed 2026-06-08), with victims staged and posted in bulk after ransom deadlines lapsed.
2. Deadline-batch publication — victims compromised over prior weeks, posted simultaneously when negotiation windows expired. Dwell-time math places intrusions in the early-to-mid August 2026 window.

Initial Access Vector Correlation (CISA KEV)

Detection Engineering

The following detections target QILIN's documented kill chain: edge-device exploitation → credential theft → PsExec/WMI lateral movement → Rclone exfiltration → VSS destruction → encryption.

---
title: QILIN Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 9f3a2c1e-7b4d-4e8a-a1c2-q1l1n000001a
status: production
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a near-universal QILIN pre-detonation step observed 24-72h before encryption.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1490/
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete shadows /all'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows
  - IT disk management scripts
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: QILIN Ransomware - Lateral Movement via PsExec or WMI Remote Execution
id: 9f3a2c1e-7b4d-4e8a-a1c2-q1l1n000002b
status: production
description: Detects PsExec service installation and WMI remote process creation consistent with QILIN affiliate mass-deployment of encryptors across domain hosts, frequently via GPO or admin shares.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith: '\PSEXESVC.exe'
    - CommandLine|contains:
        - 'psexec'
        - '-accepteula'
        - '\\ADMIN$'
        - '\\IPC$'
  selection_wmi:
    Image|endswith: '\WmiPrvSE.exe'
    CommandLine|contains:
      - 'powershell'
      - 'cmd.exe'
      - '.bat'
      - '.exe /c'
  condition: 1 of selection_psexec or selection_wmi
falsepositives:
  - SCCM/MECM software distribution
  - Legitimate administrative remote management
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
---
title: QILIN Ransomware - Rclone Data Exfiltration to Cloud Storage
id: 9f3a2c1e-7b4d-4e8a-a1c2-q1l1n000003c
status: production
description: Detects execution of Rclone (or renamed copies) with cloud-storage copy/sync arguments — QILIN's primary bulk exfiltration tool to MEGA and other providers before leak-site posting.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1567/002/
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'rclone'
      - '--config'
      - 'copy '
      - 'sync '
      - 'mega'
      - ':s3'
      - 'dropbox'
      - '--transfers'
      - '--bwlimit'
  selection_susp_path:
    Image|contains:
      - '\Temp\'
      - '\AppData\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: selection_cmd or selection_susp_path
falsepositives:
  - Legitimate cloud backup tooling (rare in most enterprises)
level: critical
tags:
  - attack.exfiltration
  - attack.t1567.002

KQL — Microsoft Sentinel: Pre-Ransomware Staging & Lateral Movement Hunt (QILIN Toolset)

// QILIN pre-encryption staging hunt — correlates credential access,
// PsExec/WMI lateral movement, shadow copy tampering, and Rclone exfil
// Run over the last 7 days; any host hitting 2+ categories = immediate IR escalation
let Lookback = 7d;
let SuspiciousHosts =
    union
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "resize shadowstorage")
    | extend Category = "VSS_Tampering",
    | project TimeGenerated, DeviceName, AccountName, Category, ProcessCommandLine),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "PSEXESVC.exe"
       or ProcessCommandLine has_any ("psexec", "\\ADMIN$", "\\IPC$")
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe", "powershell.exe"))
    | extend Category = "Lateral_Movement"
    | project TimeGenerated, DeviceName, AccountName, Category, ProcessCommandLine),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("rclone", "mega", "--transfers", "--bwlimit")
    | extend Category = "Exfil_Staging"
    | project TimeGenerated, DeviceName, AccountName, Category, ProcessCommandLine),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("sekurlsa", "lsadump", "mimikatz", "procdump", "lsass")
    | extend Category = "Credential_Access"
    | project TimeGenerated, DeviceName, AccountName, Category, ProcessCommandLine);
SuspiciousHosts
| summarize Categories = make_set(Category),
            CategoryCount = dcount(Category),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            SampleCommands = make_set(ProcessCommandLine, 5)
    by DeviceName, AccountName
| where CategoryCount >= 2
| order by CategoryCount desc, FirstSeen asc

PowerShell — Rapid Triage: QILIN Pre-Detonation Indicator Sweep

# QILIN Rapid Triage Script — run on suspect hosts or via GPO/Intune fleet-wide
# Checks: shadow copies intact, new scheduled tasks (7d), suspicious services,
# exposed RDP, recently added local admins, Rclone presence
$Report = @()
$Cutoff = (Get-Date).AddDays(-7)

Write-Host "[1] Volume Shadow Copies..." -ForegroundColor Cyan
$Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $Shadows) { $Report += "[!] ALERT: No shadow copies found — possible vssadmin deletion (QILIN T1490)" }
else { $Report += "[OK] $($Shadows.Count) shadow copies present, oldest: $(($Shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate)" }

Write-Host "[2] Scheduled tasks created in last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskXml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
    if ($taskXml -match '<Date>([^<]+)</Date>') {
        $created = [datetime]$Matches[1]
        if ($created -gt $Cutoff) { $Report += "[!] New task: $($_.TaskName) created $created — action: $($_.Actions.Execute) $($_.Actions.Arguments)" }
    }
}

Write-Host "[3] Suspicious services (PsExec/random-name services)..." -ForegroundColor Cyan
Get-Service | Where-Object { $_.Name -match '^(PSEXESVC|[a-z0-9]{7,8})$' } | ForEach-Object {
    $Report += "[!] Suspicious service: $($_.Name) — State: $($_.Status)"
}

Write-Host "[4] RDP exposure check..." -ForegroundColor Cyan
$RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
if ($RdpEnabled) {
    $Nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
    $Report += "[!] RDP ENABLED. NLA: $(if($Nla){'On'}else{'OFF — CRITICAL RISK'}) — restrict via firewall/VPN immediately"
}

Write-Host "[5] Local admins added in last 7 days..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$Cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Administrators' } | ForEach-Object {
        $Report += "[!] Account added to Administrators: $($_.TimeCreated) — $($_.Message.Substring(0,[Math]::Min(200,$_.Message.Length)))"
    }

Write-Host "[6] Rclone / exfil tooling artifacts..." -ForegroundColor Cyan
@("$env:TEMP","$env:ProgramData","$env:PUBLIC","C:\") | ForEach-Object {
    Get-ChildItem $_ -Recurse -Depth 2 -Filter "rclone*" -ErrorAction SilentlyContinue | ForEach-Object {
        $Report += "[!] Rclone binary found: $($_.FullName) (LastWrite: $($_.LastWriteTime))"
    }
}

$Report | Out-File "$env:TEMP\qilin_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
$Report | ForEach-Object { Write-Host $_ }

Incident Response Priorities — QILIN Playbook

T-Minus Detection Checklist (BEFORE Encryption Fires)

QILIN's typical 48–72 hour pre-detonation staging window produces these signals — catching any two means you're inside the kill chain:

• Shadow copy deletion commands (vssadmin delete shadows, bcdedit ... recoveryenabled no) — the single highest-fidelity pre-encryption indicator
• Rclone/MEGA network egress — sudden multi-GB outbound transfers to consumer cloud storage from servers, especially file servers and domain controllers
• PsExec service creation events (7045) across multiple hosts within a short window — encryptor staging
• GPO modification events — QILIN pushes encryptors via Group Policy after DA compromise; alert on any new GPO linking to Computer Configuration → Scripts or Software Installation
• Backup server access anomalies — interactive logons or new processes on Veeam/Commvault hosts from non-backup-admin accounts
• AV/EDR tampering — service stop attempts against Defender/CrowdStrike/SentinelOne; QILIN affiliates routinely attempt bcdedit safeboot and safe-mode boot staging
• ScreenConnect/AnyDesk sessions from unrecognized operator IPs on hosts that don't normally run RMM

Critical Assets QILIN Prioritizes for Exfiltration

1. Legal and executive communications — the law-firm victim this cycle reinforces their preference for privileged material
2. Financial records, payroll, and insurance policies (they read your cyber-insurance coverage to calibrate demands)
3. HR/PII databases — leak-site leverage
4. IP and engineering data — manufacturing/tech victims (CAD files, schematics, source code)
5. Backup catalogs and credentials — not exfil for publication, but harvested to destroy recovery options

Containment Actions — Ordered by Urgency

1. Isolate suspected staging hosts from the network (EDR network containment, not just AV quarantine) — preserve memory for forensics
2. Disable compromised accounts and force enterprise-wide credential resets, starting with Domain Admins, backup admins, and any account used in lateral movement
3. Block egress to MEGA, Dropbox, and unauthorized cloud storage at the proxy/firewall immediately — if exfil is still in flight, this is the only lever that reduces leak-site exposure
4. Sever VPN/edge access pending review of Check Point/RMM appliance logs for CVE-2026-50751 / CVE-2024-1708 exploitation artifacts
5. Protect backups: take repositories offline/immutable now — do NOT trust that they haven't been enumerated
6. Preserve VPN appliance, firewall, and DC logs before any patching or reboots — Check Point exploitation evidence is volatile
7. Engage IR counsel early — with a law firm and a financial services firm hit this cycle, assume regulatory notification clocks are ticking for any PII exposure

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway for CVE-2026-50751 — this is the leading initial-access hypothesis for the August batch. If patching requires a window, disable IKEv1 VPN features and restrict portal/VPN access to known IP ranges in the interim
• Patch or isolate ConnectWise ScreenConnect (CVE-2024-1708) — if self-hosted and unpatched, treat it as already compromised: audit App_Extensions and user.xml for rogue accounts
• Block Rclone and unauthorized cloud-storage egress at the perimeter (MEGA, Dropbox, pCloud unless business-justified)
• Disable RDP from the internet entirely; enforce NLA + MFA for any internal RDP; alert on brute-force patterns (4625 bursts followed by 4624)
• Enable and verify tamper protection on all EDR/AV agents; alert on any attempt to stop security services or modify safeboot configuration
• Audit GPO change control — alert on any new or modified GPOs; require dual approval for GPO edits in the next 30 days
• Verify backup immutability and confirm at least one offline/air-gapped copy exists and restores (QILIN specifically hunts Veeam)

Short-Term (2 Weeks)

• Segment backup infrastructure onto a dedicated management VLAN with no inbound access from user/server subnets; separate backup credentials from AD (no shared admin accounts)
• Deploy decoy/honey credentials and canary fileshares — QILIN affiliates enumerate aggressively and trip these reliably during the staging phase
• Enforce phishing-resistant MFA (FIDO2) for all remote access, VPN, and administrative interfaces — credential-based entry remains their bread and butter
• Exchange Server hardening (CVE-2023-21529): apply all cumulative updates, enable Extended Protection, and restrict EWS/remote PowerShell to admin subnets
• Deploy the Sigma detections above into your SIEM and run the Sentinel KQL hunt retroactively over 30 days — if QILIN's staging pattern exists in your environment, you want to find it before they finish exfil
• Restrict lateral movement protocols: disable PsExec-style admin share usage via Windows Firewall rules on workstations; constrain WMI/WinRM to admin jump boxes only
• Tabletop a double-extortion scenario with legal, comms, and insurance — QILIN's leak-site countdown timers don't wait for your decision tree to be invented mid-crisis

Analyst's Note

The Italian education/publishing cluster (Loescher, Zanichelli) alongside Coface and Mulino Padano within the same posting burst is the most under-appreciated signal in this dataset. Four Italian victims in one day is not random — it is consistent with upstream compromise of a shared MSP or a regionally prevalent vulnerable appliance. Italian mid-market organizations and their service providers should treat this as a directed threat, not background noise. Security Arsenal will continue monitoring the QILIN leak site for sample-data drops that may confirm the shared-vector hypothesis.

This briefing is based on live leak-site telemetry as of 2026-08-17. Victim postings represent adversary claims; inclusion does not independently confirm compromise.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub