Live leak-site monitoring shows QILIN added four victims between 2026-09-07 and 2026-09-09: Jet Specialty in US manufacturing, Alaska Electrical Apprenticeship in US education, Partners Group SK in South Korea financial services, and Jbc in Spain with sector not reliably classified. The cluster is small but operationally consistent with QILIN: mixed enterprise and mid-market victims, cross-border extortion, and pressure timed around credential or perimeter-access weaknesses.
For defenders, the priority is not attribution lore; it is interrupting the quiet phase before encryption. Assume valid-account abuse at VPN or remote access, rapid discovery, staged archive creation, and shadow-copy deletion.
Threat Actor Profile — QILIN
- Known aliases: Qilin, Agenda ransomware lineage in public reporting; leak-site branding varies by affiliate.
- Model: Ransomware-as-a-Service with affiliates handling intrusion and negotiation while core operators maintain payload, leak site, and payment infrastructure.
- Ransom behavior: commonly mid-six to seven-figure demands scaled to victim revenue, cyber-insurance signals, and perceived downtime sensitivity.
- Initial access: exposed remote services, VPN or gateway exploitation, phishing with macro or loader chains, purchased access from brokers, and abused remote monitoring tools.
- Extortion: double extortion is standard; data theft claims are used even when public proof is delayed. Threats may escalate from leak-site teaser posts to named countdowns and sample data.
- Dwell time: frequently days to a few weeks from access to detonation; education and smaller industrial victims often show shorter operational pauses once domain-level access is achieved.
- Typical tooling: legitimate admin utilities, PowerShell, WMI, PsExec or SMB service creation, RDP for hands-on movement, archiving utilities, cloud sync or FTP-style exfiltration, and VSS deletion before encryption.
Current Campaign Analysis
Sector targeting
Manufacturing and education in the United States dominate this window, with one South Korea financial-services posting and one Spanish victim lacking reliable sector mapping. That spread suggests opportunistic access-driven selection rather than a single vertical exploit: organizations with remote access exposure, lean weekend staffing, complex vendor connectivity, or weak MFA remain attractive.
Geographic concentration
The victim set is US-heavy but not US-exclusive: US, South Korea, and Spain. QILIN has historically favored North America and Europe while retaining global affiliate reach. A single SK financial-services victim should not be read as a Korea-specific campaign, but regional financial entities should treat it as proof of current affiliate interest.
Victim profile
The named organizations fit a mid-market profile: specialized manufacturing, workforce training, and financial services. Estimated revenue bands are likely from roughly USD 10M to USD 500M, with education nonprofit or apprenticeship operations possibly lower. These victims often have high downtime pain, limited 24/7 SOC depth, and enough sensitive data to make leak threats credible.
Posting frequency and escalation
Four postings in three days is a moderate operational tempo for this actor. The back-to-back 2026-09-07 posts followed by daily additions indicate active queue management rather than a one-off. Expect silent victims between public posts; leak-site cadence usually undercounts active intrusions by design.
CVE linkage as candidate initial access
No public proof ties these four posts to a single CVE. Treat the listed KEV items as exposure context, not confirmed root cause. CVE-2026-50751 is the highest concern for edge access because improper authentication in Check Point IKEv1 key exchange maps cleanly to ransomware initial access. CVE-2024-1708 remains relevant where ConnectWise ScreenConnect is exposed. CVE-2026-48027 points to developer-workstation supply-chain risk. CVE-2025-60710 and CVE-2023-21529 are more likely privilege-escalation or post-auth enablers than first-touch vectors. Validate perimeter, remote administration tooling, Exchange hygiene, and endpoint tamper signals in parallel.
Detection Engineering
---
title: QILIN Initial Access - Suspicious VPN or Gateway Logon Followed by Admin Tool Execution
id: 7b2f1a30-9qil-4a11-8c01-qilinvpn001
status: experimental
description: Detects a remote authentication success from an unusual source followed within a short window by execution of tools commonly used by QILIN affiliates for discovery or lateral movement.
author: Security Arsenal CTI
date: 2026/09/10
references:
- https://securityarsenal.com/darkside
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\nl.exe'
- '\psexec.exe'
- '\psexesvc.exe'
- '\wmic.exe'
- '\powershell.exe'
- '\rclone.exe'
- '\7z.exe'
- '\winrar.exe'
- '\vssadmin.exe'
- '\bcdedit.exe'
selection_cli:
CommandLine|contains:
- 'shadowcopy'
- 'delete shadows'
- ' recoveryenabled no'
- ' /node:'
- ' -accepteula'
- ' --transfers'
- ' copy '
- ' a -m'
condition: selection_img and selection_cli
falsepositives:
- Administrative maintenance, backup software, sanctioned remote support
level: high
tags:
- attack.initial_access
- attack.t1133
- attack.t1021
- attack.t1490
---
title: QILIN Pre-Encryption Staging - Archive Creation Plus Volume Shadow Copy Tamper
id: 8d3c2b41-9qil-4b22-9d02-qilstage002
status: experimental
description: Identifies compression or archive utility execution closely associated with VSS deletion, boot configuration tampering, or mass file rename activity.
author: Security Arsenal CTI
date: 2026/09/10
references:
- https://securityarsenal.com/darkside
logsource:
category: process_creation
product: windows
detection:
selection_archive:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
- '\tar.exe'
selection_tamper:
Image|endswith:
- '\vssadmin.exe'
- '\wmic.exe'
- '\bcdedit.exe'
- '\wbadmin.exe'
CommandLine|contains:
- 'delete shadows'
- 'shadowcopy delete'
- 'delete catalog'
- 'recoveryenabled no'
- 'ignoreallfailures'
timeframe: 10m
condition: selection_archive and selection_tamper
falsepositives:
- Backup administrators clearing shadow copies during maintenance windows
level: critical
tags:
- attack.collection
- attack.t1560.001
- attack.impact
- attack.t1490
---
title: QILIN Exfiltration - Rclone or Sync Tool to Rare External Destination
id: 9e4d3c52-9qil-4c33-ae03-qilexfil003
status: experimental
description: Hunts for command-line cloud synchronization or copy tools launched from server contexts or by accounts not normally associated with backup operations.
author: Security Arsenal CTI
date: 2026/09/10
references:
- https://securityarsenal.com/darkside
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '\rclone.exe'
- '\megacmd.exe'
- '\filezilla.exe'
- '\winscp.exe'
- '\curl.exe'
- '\ftp.exe'
selection_args:
CommandLine|contains:
- ' --config'
- ' --transfers'
- ' --bwlimit'
- ' sync '
- ' copy '
- ' move '
- ' mega:'
- ' s3:'
- ' drive:'
filter_known:
ParentImage|endswith:
- '\backupagent.exe'
- '\veeam.agent.exe'
condition: selection_tool and selection_args and not 1 of filter_known*
falsepositives:
- Approved cloud backup jobs, developer artifact upload, IT file migration
level: high
tags:
- attack.exfiltration
- attack.t1567
- attack.t1048
let lookback = 7d;
let suspicious_tools = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","7z.exe","winrar.exe","vssadmin.exe","bcdedit.exe","nl.exe"]);
let auth =
SigninLogs
| where TimeGenerated >= ago(lookback)
| where ResultType == 0
| where AppDisplayName has_any ("VPN","Remote","RDP","Gateway") or IPAddress has_any ("0.0.0.0")
| project AuthTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName in~ (suspicious_tools)
| extend CommandLine = tostring(ProcessCommandLine)
| where CommandLine has_any ("shadowcopy","delete shadows","recoveryenabled no","-accepteula","/node:","--transfers"," copy "," sync ") or FileName has_any ("psexec","rclone","vssadmin")
| join kind=leftouter (auth) on $left.AccountName == $right.UserPrincipalName
| project DeviceName, TimeGenerated, AccountName, FileName, CommandLine, AuthTime, IPAddress, AppDisplayName, Location
| extend HoursSinceRemoteAuth = iff(isnull(AuthTime), real(null), datetime_diff("hour", TimeGenerated, AuthTime))
| where isnull(HoursSinceRemoteAuth) or HoursSinceRemoteAuth between (0 .. 48)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(CommandLine, 20), Devices=make_set(DeviceName, 20) by AccountName, IPAddress
| order by LastSeen desc;
# Rapid QILIN pre-ransomware sweep: exposed RDP, new scheduled tasks, suspicious services, VSS health
$days = 7
$since = (Get-Date).AddDays(-$days)
$report = [ordered]@{}
$report.RDPListening = [bool](Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue)
$report.RDPFirewallRules = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Where-Object Enabled -eq True | Select-Object DisplayName, Profile, Direction, Action
$report.NewScheduledTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {$_.Date -ge $since} | Select-Object TaskName, TaskPath, Date, Author, State
$report.NewServices = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object {$_.InstallDate -ge $since -or $_.StartName -match 'LOCALSYSTEM'} | Select-Object Name, DisplayName, PathName, StartName, State, InstallDate
$report.ShadowCopies = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID, InstallDate, VolumeName, Count
$report.VssDeleteEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=524; StartTime=$since} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, ProviderName, Message
$report.SuspiciousProcesses = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {$_.Name -match 'psexec|psexesvc|rclone|7z|winrar|vssadmin|bcdedit|wmic' -and $_.CreationDate -ge $since} | Select-Object Name, ProcessId, CommandLine, CreationDate, ExecutablePath
$report | ConvertTo-Json -Depth 6 | Out-File "$env:TEMP\qilin_rapid_sweep.json" -Encoding UTF8
Write-Output "Wrote $env:TEMP\qilin_rapid_sweep.json"
Incident Response Priorities
T-minus detection checklist before encryption fires
- New or unusual VPN, gateway, RDP, or remote-support logons outside normal geography and shift windows.
- Privileged group changes, especially Domain Admins, Enterprise Admins, local Administrators, or backup admins.
- Execution of PsExec-style services, WMIC remote process creation, or SMB ADMIN$ writes on multiple hosts.
- Mass reads from file shares followed by 7-Zip, RAR, rclone, WinSCP, FileZilla, MEGA, or FTP-like traffic.
- VSS deletion, backup catalog deletion, boot recovery disablement, EDR service stops, or security log clearing.
- New scheduled tasks or services created in the last 7 days with SYSTEM context and random names.
- DCSync-style replication requests, LSASS access, or NTDS.dit access from non-DC hosts.
Critical assets historically prioritized for exfiltration
- Domain controllers and identity stores: NTDS.dit, LSASS secrets, AD CS material, privileged credential vault exports.
- File servers with contracts, HR, finance, payroll, student records, donor data, M&A, legal, engineering drawings, and customer PII.
- Backup infrastructure and NAS targets to weaken recovery before extortion.
- ERP, PLM, CAD, and manufacturing execution data for industrial victims; SIS, LMS, and registrar data for education; client portfolio and payment data for financial services.
- Email executive mailboxes for negotiation leverage and proof-of-access samples.
Containment actions ordered by urgency
- Isolate suspected hosts from the network but do not power off unless destructive encryption is active and memory capture is impossible.
- Disable or rotate exposed VPN, gateway, remote-support, and service accounts; revoke sessions and tokens.
- Block egress to known exfil channels and newly observed cloud storage domains at proxy and firewall.
- Freeze credential use: force resets for affected privileged accounts, then tier-0 accounts, then broad user sets if scope is unclear.
- Protect backups: take backup consoles offline from production auth paths, verify immutable copies, and snapshot key systems.
- Kill malicious services/tasks only after capturing process, service binary, task XML, network connections, and prefetch or ShimCache evidence where available.
- Preserve volatile data: memory, running processes, network connections, logged-on sessions, open handles, and PowerShell history.
- Notify legal, cyber insurance, executives, and regulator counsel early if regulated data is in scope.
Hardening Recommendations
Immediate — next 24 hours
- Patch or mitigate Check Point IKEv1 improper authentication exposure under CVE-2026-50751; disable legacy IKEv1 where business feasible.
- Remove internet exposure for ConnectWise ScreenConnect and validate CVE-2024-1708 remediation; require MFA and unique instance URLs.
- Enforce phishing-resistant MFA for VPN, remote access, email, cloud admin, and privileged accounts; block legacy auth.
- Disable RDP from the internet, restrict RDP by host firewall to admin jump boxes, and alert on 3389 listening on unexpected servers.
- Block or tightly allow-list PsExec, rclone, 7-Zip on servers, WinSCP, FileZilla, MEGA tools, and unsigned remote access binaries.
- Enable tamper protection, restrict vssadmin and bcdedit to admin break-glass paths, and alert on shadow copy deletion.
- Verify offline or immutable backups and perform one restore test for a critical server.
Short-term — next 2 weeks
- Segment identity tiers so workstation compromise cannot reach domain controllers, backup control planes, or hypervisor management.
- Deploy just-in-time admin access and remove standing Domain Admin rights from daily accounts.
- Add egress filtering with category blocks for anon file sharing and new domains; require proxy authentication for server outbound traffic.
- Implement application control on servers and high-risk endpoints; baseline approved admin utilities.
- Centralize VPN, firewall, EDR, identity, backup, DNS, and proxy telemetry into Sentinel or equivalent with 14-day hot retention for hunting.
- Establish leak-site monitoring and crisis playbooks for double extortion, including legal and communications decision trees.
- For education and manufacturing, specifically protect vendor remote maintenance pathways and student or plant-floor jump hosts that often bypass enterprise controls.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.