Classification: TLP:CLEAR | Publication Date: 2026-10-27 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

QILIN Ransomware Gang: 34 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules

Executive Summary

On 2026-10-26, the QILIN ransomware operation published 15 new listings on its dark web leak site in a single 24-hour window, part of 34 claimed victims across the group's most recent 100 postings. QILIN claims to have compromised organizations spanning Energy & Utilities, Manufacturing, Technology, Healthcare, Retail & E-Commerce, Professional Services, and Financial Services across eight countries, with a heavy concentration in the United States.

Every listing analyzed here is a claim made by a criminal organization. None of these listings confirm that a breach occurred. However, QILIN's operational tempo, sector selection, and historical follow-through on extortion demands make this campaign a high-priority hunting trigger for defenders in the named sectors. This briefing provides detection engineering content mapped to QILIN's known tradecraft so security teams can hunt proactively — regardless of whether their organization appears on the site.

Sourcing & Verification

This briefing is built from crawler observations of QILIN's .onion leak site aggregated via ransomware.live. Readers must understand the limits of this data:

• Corroboration status: Of the 34 listings reviewed, 7 were independently observed by a second leak-site crawler (multi-source), and 27 appear on a single source only. Multi-source corroboration means two independent crawlers saw the gang post the claim — it does not mean a breach is confirmed.
• Claims, not confirmations: Inclusion on a leak site reflects the threat actor's accusation only. No tier in this data — including multi-source — confirms that any named organization was breached. Only the organization itself or its regulator can confirm an incident.
• Neither silence nor denial settles the question: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Absence of a public statement should not be read in either direction.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Named organizations below are listed exactly as QILIN presented them, with no independent verification implied.

Threat Actor Profile — QILIN

Aliases: Qilin, Agenda (the ransomware family was briefly branded "Agenda" in mid-2022 before the operation standardized on Qilin).

Operating model: QILIN runs a Ransomware-as-a-Service (RaaS) program, recruiting affiliates through underground forums and taking a revenue share (historically reported in the 15–20% range for affiliates). The operation maintains its own Tor-based negotiation portal and public leak site. Affiliates are typically responsible for initial access and lateral movement, while the core group operates the encryptor builds, negotiation infrastructure, and leak-site publishing. This affiliate model explains the sector diversity in the current posting wave — different affiliates bring different access pipelines.

Technical notes: The Qilin encryptor has been distributed in both Golang and Rust variants, with configurable build options allowing affiliates to tailor encryption scope, process kill-lists, and propagation behavior per victim. The Rust variant notably supports targeting VMware ESXi environments.

Typical ransom demands: Demands vary widely by victim revenue, historically ranging from the low six figures for small professional-services firms into the multi-million-dollar range for healthcare and energy targets. QILIN negotiators are known to adjust demands after reviewing exfiltrated financial documents.

Known initial access methods (historical tradecraft — not attributed to any specific named victim below):

• Spear phishing with malicious attachments or links leading to credential harvesting and loader deployment
• Exposed remote access services — exploitation or brute forcing of VPN gateways and RDP endpoints
• Valid accounts purchased from initial access brokers (IABs)
• Exploitation of internet-facing appliances and management planes (firewalls, virtualization management, CI/CD infrastructure) — see the CVE discussion in Campaign Analysis

Double extortion: QILIN operates a classic double-extortion model: data is staged and exfiltrated before encryption, and victims who refuse to pay for decryption are threatened with public data release on the leak site in staged "proof" tranches. The 15 listings published on 2026-10-26 represent organizations that, per the gang's own claim narrative, have not met demands within its negotiation window.

Average dwell time: Reported dwell time for QILIN affiliates has historically ranged from roughly 2 to 11 days between initial access and detonation, with the exfiltration phase typically beginning in the final 48–96 hours. This dwell window is the defender's opportunity: the pre-encryption staging activity is noisy and detectable.

Current Campaign Analysis

Sectors Being Targeted

Based on the last 100 postings (34 recent victims), QILIN's current claimed targeting spans:

The simultaneous appearance of energy utilities and healthcare in a single posting batch is notable — these are sectors where operational downtime carries the highest pressure to pay, and where QILIN affiliates have historically concentrated negotiation effort.

Geographic Concentration

Claimed victims span US, GB, ES, DE, CA, AU, MM, and CH, with the United States dominating the current wave (8 of 15 listings published 2026-10-26). Western Europe (GB, DE, ES) forms a clear secondary cluster. This is consistent with QILIN's affiliate economy: English-language negotiation capability and high cyber-insurance penetration make US and UK mid-market organizations the most monetizable targets.

Victim Profile

The named organizations skew toward the mid-market: regional utilities, specialty manufacturers, medical practices, a school district, a law firm, and a wholesale lender. These are organizations typically large enough to carry cyber-insurance or pay a six-to-seven-figure ransom, but small enough to lack 24/7 SOC coverage and mature EDR deployment — the classic QILIN sweet spot.

Organizations Listed on the Leak Site (published 2026-10-26)

The following organizations have been named by QILIN on its leak site. All 15 are single-source listings — one crawler observed the claim, with no second-crawler confirmation that the posting exists, and no confirmation of any kind that a breach occurred:

• Delta Electric Power Association (Energy & Utilities, US)
• Bangor Wholesale Laminates (Manufacturing, GB)
• TeleTronic (Technology, ES)
• FIRMENGRUPPE APPL Holding GmbH (Other, DE)
• Premier Medical Group (Healthcare, US)
• Zachary Confections (Retail & E-Commerce, US)
• THOMAS JORDAN, P.A (Professional Services, US)
• Five Star Sheets (Retail & E-Commerce, US)
• Power Funding (Financial Services, GB)
• Mountain Rheumatology (Healthcare, US)
• Taubensee Steel & Wire (Manufacturing, DE)
• Natural Energy Laboratory of Hawaii Authority (Energy & Utilities, US)
• Burnaby Schools - School District 41 (Education, CA)
• Miller Stratvert (Not Found, US)
• Seufert Construction (Manufacturing, US)

We reiterate: a leak-site listing is an accusation by a criminal organization. It is not evidence of compromise.

Posting Frequency & Escalation

Fifteen listings in a single day represents an elevated publishing cadence. Leak-site batch dumps of this size typically indicate one of two things: (1) multiple affiliates closing out negotiation windows simultaneously, or (2) an intentional "pressure wave" to demonstrate operational scale and deter non-payment across the broader victim pool. QILIN has used both patterns historically. Defenders should treat batch posting days as an indicator that other intrusions from the same affiliate wave may still be in their dwell period.

Connection to Actively Exploited CVEs — Hypothesis Only

We have no evidence linking any specific CVE to any specific named victim above. What we can say at the sector level: QILIN affiliates are known to favor exploitation of internet-facing management infrastructure as an access vector, and the following CISA KEV entries — all confirmed as exploited in ransomware operations — map directly to that tradecraft and constitute plausible exposure for organizations in the targeted sectors:

• CVE-2026-59310 — Broadcom VMware vCenter Path Traversal (KEV 2026-08-18): vCenter compromise is force-multiplier access — it frequently yields credentials and direct paths to ESXi hosts, which QILIN's Rust encryptor variant specifically targets.
• CVE-2026-63077 — JetBrains TeamCity Deserialization (KEV 2026-08-05): CI/CD server compromise provides both code-signing material and a lateral movement launchpad; particularly relevant to the Technology-sector claims.
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-coded Password (KEV 2026-07-29): FMC compromise exposes the security management plane itself.
• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1) (KEV 2026-06-08): VPN gateway exploitation aligns squarely with QILIN's documented reliance on remote-access vectors for initial entry.
• CVE-2026-48027 — Nx Console Embedded Malicious Code (KEV 2026-05-27): supply-chain exposure relevant to technology and professional-services firms with development pipelines.

Treat these as sector-level exposure hypotheses to drive patch prioritization, not as attribution.

Detection Engineering

The following detections target QILIN's known tradecraft across the kill chain: remote-access exploitation and macro execution at initial access, PsExec/WMI lateral movement, and pre-encryption data staging. Deploy and tune against your environment's baselines.

---
title: QILIN Initial Access - Office Macro Spawning Script Interpreter
description: Detects Microsoft Office processes spawning script interpreters or command shells, consistent with QILIN affiliate phishing-macro execution chains
id: 8f3a1c2e-7b4d-4e91-a2c5-qln000001
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Office add-ins (rare); baseline by parent/command-line hash
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059

---
title: QILIN Lateral Movement - PsExec Service Installation or WMI Remote Process Creation
description: Detects PsExec-style service creation (PSEXESVC) or WMI remote process execution, both observed in QILIN affiliate lateral movement prior to encryption
id: 8f3a1c2e-7b4d-4e91-a2c5-qln000002
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
detection:
  selection_psexec:
    - EventID: 7045
      ServiceName|contains: 'PSEXESVC'
    - EventID: 4697
      ServiceFileName|contains: 'PSEXESVC'
  selection_wmi:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
    NewProcessName|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\net.exe'
      - '\psexec.exe'
      - '\vssadmin.exe'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Administrative tooling (SCCM, PDQ, legitimate PsExec); alert on non-standard source hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002

---
title: QILIN Pre-Encryption Staging - Shadow Copy Deletion and Mass Archive Creation
description: Detects Volume Shadow Copy deletion commands and mass compression-tool execution consistent with QILIN pre-encryption sabotage and exfiltration staging
id: 8f3a1c2e-7b4d-4e91-a2c5-qln000003
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled no'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
  condition: selection_vss or selection_archive
falsepositives:
  - Backup software; system administrators performing legitimate archival or VSS maintenance
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

KQL — Microsoft Sentinel Hunt Query

Hunts for the QILIN pre-detonation sequence: remote-access logon from an unusual source, followed by remote execution tooling and staging activity on the same host within a 72-hour window. Run against the last 14 days and pivot on any host hitting multiple stages.

let lookback = 14d;
let window = 72h;
let SuspiciousLogons =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where ResultType == 0
    | where AppDisplayName has_any ("VPN", "RDP", "Remote Desktop") or ClientAppUsed == "Remote Desktop"
    | summarize FirstLogon=min(TimeGenerated) by Account=UserPrincipalName, SourceIP=IPAddress, Device=DeviceDisplayName;
let RemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe" or FileName in~ ("psexec.exe", "psexesvc.exe")
    | summarize FirstExec=min(TimeGenerated), ExecCmds=make_set(ProcessCommandLine, 10) by DeviceName, Account=InitiatingProcessAccountName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName in~ ("vssadmin.exe", "bcdedit.exe") and ProcessCommandLine has_any ("delete shadows", "recoveryenabled no"))
        or (FileName in~ ("7z.exe", "7za.exe", "rar.exe") and ProcessCommandLine has_any (" -p", " a "))
    | summarize FirstStaging=min(TimeGenerated), StagingCmds=make_set(ProcessCommandLine, 10) by DeviceName, Account=InitiatingProcessAccountName;
RemoteExec
| join kind=inner Staging on DeviceName
| where FirstStaging between (FirstExec .. (FirstExec + window))
| join kind=leftouter SuspiciousLogons on $left.Account == $right.Account
| project DeviceName, Account, FirstExec, ExecCmds, FirstStaging, StagingCmds, SourceIP, FirstLogon
| order by FirstExec asc;

Rapid-Response Hardening / Triage Script

Run this PowerShell triage script on any host suspected of involvement in a pre-encryption staging phase. It checks three QILIN-relevant indicators: exposed RDP configuration, scheduled tasks created in the last 7 days (a common persistence mechanism), and Volume Shadow Copy tampering.

# Security Arsenal — QILIN Pre-Ransomware Triage Script
# Run elevated. Outputs to console and %TEMP%\qilin_triage_<host>.txt

$out = "$env:TEMP\qilin_triage_$env:COMPUTERNAME.txt"
"=== QILIN Triage — $env:COMPUTERNAME — $(Get-Date -Format 'yyyy-MM-dd HH:mm') ===" | Out-File $out

# 1. RDP exposure check
"`n--- RDP CONFIGURATION ---" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$port = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES — REVIEW EXPOSURE'}else{'No'})" | Out-File $out -Append
"NLA Enforced: $(if($nla.UserAuthentication -eq 1){'Yes'}else{'NO — ENABLE NLA IMMEDIATELY'})" | Out-File $out -Append
"RDP Port: $($port.PortNumber)" | Out-File $out -Append
"Recent RDP logons (Type 10, last 7 days):" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s*10' } |
  Select-Object -First 25 TimeCreated, @{n='Detail';e={($_.Message -split "`n")[0..20] -join ' '}} |
  Out-String | Out-File $out -Append

# 2. Scheduled tasks created in last 7 days (persistence)
"`n--- SCHEDULED TASKS (last 7 days) ---" | Out-File $out -Append
Get-ScheduledTask | Where-Object {
  $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} |
  Format-Table -AutoSize | Out-String | Out-File $out -Append

# 3. Volume Shadow Copy status
"`n--- VOLUME SHADOW COPIES ---" | Out-File $out -Append
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
  $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize | Out-String | Out-File $out -Append
} else {
  "NO SHADOW COPIES PRESENT — if backups rely on VSS, investigate deletion immediately (vssadmin list shadows)" | Out-File $out -Append
}
"VSS service state: $((Get-Service VSS -ErrorAction SilentlyContinue).Status)" | Out-File $out -Append

"`nTriage complete -> $out"
Get-Content $out

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

QILIN's dwell window is your detection opportunity. Hunt for, in rough kill-chain order:

1. Anomalous VPN/RDP logons — especially from new geographies, unmanaged devices, or outside business hours; cross-reference against CVE-2026-50751 (Check Point) and CVE-2026-20316 (Cisco FMC) exposure.
2. Credential dumping artifacts — lsass.exe memory access, presence of comsvcs.dll MiniDump, sekurlsa-style command lines.
3. Discovery bursts — net group "Domain Admins", nltest /dclist, arp -a, and rapid share enumeration from a single host.
4. WMI/PsExec fan-out — one workstation spawning remote processes on many servers within minutes (see Sigma rule 2).
5. Archive staging — 7z/RAR execution against file shares, especially with password flags; large outbound transfers to unfamiliar cloud storage or VPS endpoints.
6. Defense impairment — shadow copy deletion, bcdedit recovery disabling, security-service stop attempts. At this stage you are likely minutes-to-hours from detonation.

Critical Assets QILIN Historically Prioritizes for Exfiltration

• Financial records, payroll, and accounting databases (used to calibrate ransom demands)
• HR and PII stores — particularly patient data in healthcare intrusions
• Legal and contractual documents (professional-services victims)
• Email archives of executive leadership
• Backup catalogs and backup server credentials — QILIN affiliates routinely enumerate and target backup infrastructure before detonation

Containment Actions — Ordered by Urgency

1. Isolate, don't power off — network-isolate suspected staging hosts; preserve volatile memory for forensic scoping.
2. Disable the suspected compromised accounts — force credential resets for any account observed in lateral movement; revoke VPN sessions globally if gateway compromise is suspected.
3. Block egress to staging destinations — restrict outbound to known-bad IPs and unsanctioned file-sharing/cloud storage at the proxy and firewall.
4. Protect backups immediately — take backup infrastructure offline or to immutable/air-gapped state; verify shadow copies still exist across file servers.
5. Segment flat networks — apply emergency ACLs between workstation VLANs and server/management planes, especially hypervisor management (vCenter/ESXi).
6. Engage IR retainers and legal counsel early — if your organization is named on a leak site, treat it as a credible claim requiring forensic validation, not as public confirmation of an incident.

Hardening Recommendations

Immediate (24 hours)

• Patch the edge: Verify remediation status for CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), and CVE-2026-63077 (TeamCity). These are confirmed ransomware-exploited KEV entries; treat any unpatched instance as an open door.
• Kill macro execution: Block Office child processes via Attack Surface Reduction rules (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) — directly counters the phishing-macro chain in Sigma rule 1.
• Enforce MFA on all remote access — VPN, RDP gateways, and any externally reachable management portals. Audit for legacy IKEv1 configurations on Check Point gateways.
• Disable or restrict PsExec/WMI lateral tooling — block inbound 445/135 between workstation VLANs; alert on any PSEXESVC service installation.
• Protect shadow copies: Enable tamper protection; alert (don't just log) on vssadmin delete shadows and bcdedit execution.
• Deploy the Sigma rules and KQL query above into your SIEM/EDR and run the triage script against any host with suspicious remote-execution telemetry.

Short-Term (2 Weeks)

• Segment the network: Enforce tiered administration; isolate backup infrastructure, hypervisor management planes, and CI/CD servers (TeamCity) behind dedicated jump hosts with just-in-time access.
• Immutable, offline-tested backups: Move to immutable snapshots with a restore test against production-like data — QILIN targets backup catalogs before detonation.
• Egress control architecture: Deploy default-deny outbound policies with allowlisted destinations; ransomware staging dies without exfil paths.
• Identity hardening: Implement phishing-resistant MFA (FIDO2) for privileged accounts; enable LAPS and remove local-admin reuse that enables single-credential lateral movement.
• Detection-as-code pipeline: Operationalize continuous deployment of Sigma content mapped to active campaigns — this briefing's rules should reach production within days, not quarters.
• Tabletop the leak-site scenario: Run an exercise where your organization appears on a leak site with unverified claims — align legal, comms, and IR on response language and regulatory analysis before it happens.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub