QILIN Ransomware Gang: 4 New Victim Claims Posted — Education & Manufacturing Targeting, Detection Rules Included

Classification: TLP:CLEAR | Publication Date: 2026-11-15 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-11-11 and 2026-11-14, the QILIN ransomware operation published four new victim listings on its dark web leak site, naming organizations in the education and manufacturing sectors across Malaysia, the United States, and Canada. All four listings were independently observed by a second leak-site crawler, meaning we have high confidence that QILIN made these claims — but these remain unverified threat-actor assertions, not confirmed breaches.

The named organizations are: Kayaku Safety Systems Malaysia Sdn Bhd (Manufacturing, MY — listed 2026-11-14), The University of Texas at Arlington (Education, US — listed 2026-11-12), York University (Education, CA — listed 2026-11-12), and Oral Roberts University (Education, US — listed 2026-11-11).

Three of four listings target higher education — a pattern consistent with QILIN's historical appetite for data-rich, downtime-intolerant institutions with large attack surfaces and often under-resourced security teams. Security teams in education and manufacturing should treat this posting wave as a trigger to hunt for QILIN's known pre-encryption tradecraft immediately, regardless of whether their organization appears on the list.

Sourcing & Verification

• Corroboration status: 4 of 4 listings in this dataset were independently observed by a second leak-site crawler (MULTI-SOURCE). 0 listings appear on a single source only. Multi-source observation confirms the gang published the claim — it does not confirm any breach occurred.
• What inclusion means: Every organization named in this briefing is included solely because the QILIN threat actor listed it on its leak site. Inclusion reflects the threat actor's claim and is not confirmation of a breach, intrusion, or data theft.
• Disputes and denials: A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — QILIN

Aliases: Qilin, Agenda (early variant naming observed in 2022), and associated with affiliates overlapping with former REvil/BlackMatter ecosystem operators.

Operating model: Ransomware-as-a-Service (RaaS). QILIN runs a structured affiliate program, recruiting penetration-capable partners on Russian-language forums. Affiliates execute intrusions; the core team maintains the encryptor (Rust- and Golang-based variants targeting Windows, Linux, and ESXi), the Tor negotiation portal, and the leak site. Affiliate payouts are typically reported in the 80–85% range, with higher cuts for large ransoms — an incentive structure that pushes affiliates toward big-game hunting.

Ransom demands: Demand scales with victim revenue. Observed demands historically range from the low six figures for mid-market organizations to multi-million-dollar demands against large enterprises and public institutions. Universities are frequently pressured with threats to publish student PII, research data, and financial aid records.

Initial access methods (documented across campaigns):

• Spear phishing with malicious attachments or links leading to credential harvesters and loader malware
• Exploitation of exposed remote services — VPN concentrators, RDP gateways, and edge firewalls
• Valid account abuse (purchased or phished credentials), frequently against accounts lacking MFA
• Exploitation of known-vulnerable internet-facing infrastructure, including virtualization management planes and CI/CD tooling

Extortion model: Double extortion is standard. Data is staged and exfiltrated (commonly via Rclone to cloud storage or MEGA) before encryption. Leak-site publication follows failed or stalled negotiations, typically with countdown timers and staged "proof" data releases to escalate pressure.

Dwell time: Observed dwell time varies by affiliate but commonly runs 1–3 weeks from initial access to detonation, with exfiltration occurring in the final days before encryption. This window is the defender's opportunity — the detections below target exactly that phase.

Current Campaign Analysis

Sector targeting

The current posting wave skews heavily toward higher education (3 of 4 listings): The University of Texas at Arlington, York University, and Oral Roberts University. The fourth listing, Kayaku Safety Systems Malaysia Sdn Bhd, sits in manufacturing — specifically automotive safety systems, a sub-sector where production downtime carries extreme contractual and supply-chain penalties, increasing extortion leverage.

Geographic concentration

Listings span Malaysia, the United States, and Canada. The North American education cluster (2 US, 1 CA) suggests deliberate affiliate focus rather than opportunistic scatter. The Malaysian manufacturing listing is consistent with QILIN's demonstrated willingness to operate globally against organizations perceived to have cyber-insurance coverage and low tolerance for operational disruption.

Victim profile

• Universities: Large, distributed networks; tens of thousands of identities; mixed legacy and modern infrastructure; research data, student PII, and financial records — all high-value exfiltration targets. Incident response capacity is often constrained relative to attack surface.
• Manufacturing: Mid-to-large enterprise with OT-adjacent IT environments, ERP systems, and just-in-time production pressure. Safety-systems manufacturing adds regulatory and reputational sensitivity.

Posting frequency and escalation pattern

Four listings in four days (2026-11-11 through 2026-11-14) represents a concentrated burst rather than a slow drip. Clustered posting of this kind typically indicates either (a) a single affiliate completing a campaign wave and publishing stale access, or (b) coordinated pressure timing. Either way, organizations in the same sectors should assume affiliates hold additional unlisted access and hunt accordingly.

Potential initial access vectors — hypothesis only

We have no evidence tying any specific CVE to any named listing above. However, QILIN affiliates are known to exploit exactly the class of internet-facing infrastructure currently represented in CISA's Known Exploited Vulnerabilities catalog, and defenders in these sectors should prioritize validation against:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication) — edge VPN gateways are a classic ransomware ingress point; added to KEV 2026-06-08.
• CVE-2026-20316 (Cisco Secure FMC, hard-coded password) — firewall management plane compromise enables both access and defense evasion; added 2026-07-29.
• CVE-2026-59310 (VMware vCenter path traversal) — vCenter compromise is a force multiplier for mass ESXi encryption, a documented QILIN objective; added 2026-08-18.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD compromise enables supply-chain-style lateral movement with signed binaries; added 2026-08-05.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer workstation tooling as an initial foothold; added 2026-05-27.

Treat these as sector-level exposure hypotheses driving patch prioritization — not as attribution for any named organization.

Detection Engineering

The following detections target QILIN's documented playbook: edge/remote-service ingress, legitimate-tool lateral movement (PsExec/WMI), pre-encryption data staging with Rclone, and shadow-copy destruction immediately prior to detonation.

---
title: QILIN - PsExec or WMI Remote Service Creation for Lateral Movement
id: 9f1a2b3c-qln1-4a01-9a11-qlinlateral001
status: production
description: Detects service creation events consistent with PsExec-style or WMI-driven remote execution used by QILIN affiliates for lateral movement prior to ransomware deployment.
author: Security Arsenal Threat Intel
date: 2026/11/15
references:
  - https://securityarsenal.com/darkside
logsource:
  category: service_creation
  product: windows
  service: security
detection:
  selection_service:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
    ImagePath|contains:
      - '\ADMIN$\'
      - '\IPC$\'
      - 'C:\Windows\Temp\'
  selection_wmi:
    EventID: 7045
    ImagePath|startswith: 'C:\Windows\System32\wbem\'
  condition: selection_service or selection_wmi
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) - baseline and allowlist known deployment accounts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - qilin
---
title: QILIN - Rclone or Cloud Sync Exfiltration Staging
id: 9f1a2b3c-qln2-4a02-9a12-qlinexfil0002
status: production
description: Detects execution of Rclone and similar cloud sync tools commonly abused by QILIN affiliates for pre-encryption data exfiltration to MEGA or other cloud storage.
author: Security Arsenal Threat Intel
date: 2026/11/15
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\megasync.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_cmd:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
      - '--transfers'
      - '--bwlimit'
      - 'mega.nz'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup workflows - restrict detection to servers and systems without approved sync tooling
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
  - qilin
---
title: QILIN - Pre-Detonation Shadow Copy and Backup Destruction
id: 9f1a2b3c-qln3-4a03-9a13-qlinvss000003
status: production
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes - hallmark pre-encryption steps in QILIN intrusions.
author: Security Arsenal Threat Intel
date: 2026/11/15
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbdb:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Rare; legitimate storage maintenance is typically change-controlled - alert on any occurrence outside maintenance windows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
  - qilin

The KQL query below hunts Microsoft Sentinel data for a correlated pre-ransomware sequence: anomalous remote logons followed by staging-directory writes and mass file enumeration — the pattern QILIN affiliates exhibit in the 24–72 hours before detonation.

// QILIN Pre-Ransomware Staging Hunt - Microsoft Sentinel
// Hunts: anomalous RDP/network logon -> suspicious staging dir writes -> enumeration tooling
// Window: 7 days | Author: Security Arsenal Threat Intel | 2026-11-15
let Lookback = 7d;
let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where Account !endswith "$"
    | summarize LogonCount = count(), DistinctHosts = dcount(Computer),
                Hosts = make_set(Computer), FirstSeen = min(TimeGenerated)
        by Account, IpAddress
    | where DistinctHosts >= 5  // one account touching many hosts in short window = lateral movement
    | project Account, IpAddress, DistinctHosts, Hosts, FirstSeen;
let StagingActivity =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any (@"C:\ProgramData\", @"C:\Users\Public\", @"C:\Windows\Temp\")
    | where FileName has_any (".zip", ".rar", ".7z") or FolderPath has_any ("rclone", "staging", "exfil")
    | summarize StagingWrites = count(), StagingFiles = make_set(FileName, 20)
        by DeviceName, InitiatingProcessAccountName;
SuspiciousLogons
| join kind=inner (
    StagingActivity
) on $left.Account == $right.InitiatingProcessAccountName
| project Account, IpAddress, DistinctHosts, StagingWrites, Hosts, StagingFiles, FirstSeen
| sort by DistinctHosts desc, StagingWrites desc;

The PowerShell script below is a rapid-triage collector: run it on suspect hosts (or fleet-wide via your EDR/remote shell) to surface scheduled tasks created in the last 7 days (a common QILIN persistence mechanism), recent shadow-copy tampering, and exposed RDP configuration.

# QILIN Rapid Triage Collector - Security Arsenal Threat Intel - 2026-11-15
# Run elevated. Collects: new scheduled tasks (7d), VSS state, RDP exposure, recent suspicious services.
$out = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "[*] Scheduled tasks created in last 7 days..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
$out += "=== NEW SCHEDULED TASKS (7d) ===`n" + ($tasks | Format-Table -AutoSize | Out-String)

Write-Host "[*] Volume Shadow Copy state..." -ForegroundColor Cyan
$vss = vssadmin list shadows 2>&1
$out += "=== VSS SHADOWS ===`n" + ($vss | Out-String)
$vssDel = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cutoff} -ErrorAction SilentlyContinue
$out += "=== VSS SERVICE EVENTS (7d) ===`n" + ($vssDel | Out-String)

Write-Host "[*] RDP exposure check..." -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$rdpListen = Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue
$out += "=== RDP EXPOSURE ===`nfDenyTSConnections=$rdpEnabled (0=enabled) | NLA=$nla | Port3389Open=$($rdpListen.TcpTestSucceeded)`n"

Write-Host "[*] Suspicious services (PSEXESVC / temp-path binaries)..." -ForegroundColor Cyan
$svcs = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec|RemCom' -or $_.PathName -match '\\Temp\\|\\ProgramData\\.*\.exe'
} | Select-Object Name, State, PathName, StartMode
$out += "=== SUSPICIOUS SERVICES ===`n" + ($svcs | Format-Table -AutoSize | Out-String)

$out | Out-File ".\QilinTriage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Host "[+] Triage output written. Review for unauthorized tasks, missing shadows, exposed RDP, and rogue services." -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist — before encryption fires

QILIN's playbook leaves a detectable signature in the days before detonation. Hunt for, in priority order:

1. Rclone / MEGA / cloud-sync processes on servers that have no business running them — especially executing from C:\ProgramData or user-writable paths.
2. New scheduled tasks or services created outside change control, particularly running as SYSTEM from temp or ProgramData paths.
3. vssadmin delete shadows, bcdedit, or wbadmin delete catalog — any occurrence outside a documented maintenance window is a page-the-on-call event.
4. One account authenticating to many hosts (SMB/RDP/WinRM) in a compressed window — affiliate hands-on-keyboard movement.
5. Mass archive creation (zip/rar/7z) in staging directories, or enumeration tooling (netscan, AdFind, SharpHound) on non-admin workstations.
6. Group Policy changes pushing new logon scripts, software installs, or disabling security tooling — QILIN affiliates use GPO for mass detonation.

Critical assets this gang prioritizes for exfiltration

Based on documented QILIN operations, affiliates prioritize: finance and HR datastores (payroll, PII, tax records), student/patient/constituent records where applicable, legal and contract repositories, executive mailboxes, R&D and engineering file shares, backup catalogs (to destroy recovery options), and anything usable as public-shaming "proof" on the leak site. For universities: registrar systems, research data, and donor/financial-aid records. For manufacturers: ERP databases, design/CAD repositories, and supply-chain documentation.

Containment actions, ordered by urgency

1. Isolate, don't power off — network-quarantine suspect hosts via EDR/switch ACLs to preserve volatile evidence while severing C2 and lateral movement.
2. Disable compromised identities globally — force resets for any account implicated in anomalous logons; revoke sessions and tokens, not just passwords.
3. Block exfil channels at the egress — emergency-deny Rclone endpoints, MEGA, and unsanctioned cloud storage at the proxy/firewall.
4. Protect backups immediately — verify offline/immutable copies, rotate backup credentials, and isolate backup infrastructure from the production domain.
5. Snapshot edge and virtualization planes — capture VPN concentrator, firewall management, and vCenter logs before rolling log rotation destroys them.
6. Engage IR retainers and legal counsel early — do not wait for encryption; the exfiltration has likely already happened by the time you see staging.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the edge: Validate remediation of CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), and CVE-2026-59310 (vCenter) — all confirmed exploited in the wild per CISA KEV. If patching isn't possible today, apply vendor workarounds and restrict management interfaces to dedicated admin networks.
• Enforce phishing-resistant MFA on all remote access — VPN, RDP gateways, OWA, and SSO. QILIN's credential-based ingress dies against FIDO2; it thrives against SMS and push-fatigue.
• Block Rclone and unsanctioned sync tools via application control (WDAC/AppLocker) and egress filtering. There is rarely a legitimate reason for servers to run them.
• Alert on shadow-copy deletion and bcdedit changes with critical severity — deploy the Sigma rules above now.
• Audit scheduled tasks and services created in the last 30 days fleet-wide, using the triage script as a starting point.
• Segment backup infrastructure and confirm at least one immutable/offline restore point exists and actually restores.

Short-term (two weeks)

• Eliminate flat-network lateral movement: Tier-0/Tier-1/Tier-2 administration model, dedicated privileged access workstations, and SMB/RDP/WinRM restrictions between workstation VLANs. Universities with open campus networks should prioritize east-west micro-segmentation around registrar, research, and finance systems.
• Deploy decoy credentials and canary file shares in high-value datastores to catch enumeration and staging early.
• Centralize and retain logs off-box (90+ days hot) for VPN concentrators, firewalls, vCenter, and domain controllers — the affiliate dwell window exceeds default retention on most appliances.
• Harden the CI/CD and developer plane (TeamCity per CVE-2026-63077, Nx Console per CVE-2026-48027): isolate build servers, pin and verify dependencies, and treat developer workstations as high-value targets.
• Run a purple-team exercise against this exact playbook: emulate edge access → PsExec/WMI lateral movement → Rclone staging → vssadmin destruction, and verify every detection in this briefing fires.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub