QILIN Ransomware Gang: 7 Victims in 5 Days — Government, Energy & Manufacturing Targeting with Detection Rules

Classification: TLP:CLEAR | Date: 2026-09-04 | Source: Live .onion leak site monitoring via ransomware.live | Analyst: Security Arsenal — From The Dark Side

Executive Summary

Qilin (aka Agenda) has posted 7 victims in a 5-day window (2026-08-31 → 2026-09-04) to its dark web leak site, with two postings landing today alone. The victim list shows deliberate targeting of government bodies, a rural electric cooperative, and mid-market manufacturers — a profile consistent with Qilin's established preference for organizations with high operational downtime costs and weak cyber-insurance leverage. Notably, the Commission de la construction du Québec (CCQ) appears twice on the leak site (2026-09-01 and 2026-09-04), indicating either a staged data release to pressure negotiation or a re-listing after initial non-payment — a classic Qilin escalation tactic.

All organizations operating Check Point Security Gateways, ConnectWise ScreenConnect, or on-prem Exchange should treat this as an active threat advisory: every CVE in the correlated KEV set is a documented ransomware initial-access vector.

1. Threat Actor Profile — QILIN

2. Current Campaign Analysis

Victim Postings (Last 100 postings — sample window)

Sector Concentration

• Government & Defense (2 postings, 1 org ×2): CCQ re-listing strongly suggests an active negotiation failure and staged data drip. Québec public-sector entities should assume elevated targeting.
• Energy & Utilities (1): Grayson Rural Electric Cooperative is a US rural electric co-op — small IT staff, flat OT/IT networks, high societal-impact leverage. Qilin and peer groups have increasingly probed the co-op/municipal utility tier because ransom pressure-to-pay is extreme and segment maturity is low.
• Manufacturing (1): Packaging/industrial mid-market — classic Qilin sweet spot: downtime cost high, segmentation weak.
• Education (1), Retail (1), Other (1): Opportunistic spread consistent with affiliate-driven targeting.

Geographic Concentration

CA, US, CL, TR, AR — a North/South America-heavy spread. Qilin affiliates historically favor North America but this wave shows meaningful LATAM expansion (Chile, Argentina), matching a broader 2026 trend of RaaS affiliates pivoting to under-instrumented LATAM enterprises where detection latency is longer and law-enforcement pressure is lower.

Victim Profile

Estimated revenue band across the set is ~$10M–$400M — Qilin's hallmark mid-market band. Rural co-ops and regional manufacturers rarely have 24×7 SOC coverage, making them ideal for the group's typical 5–14 day dwell window.

Posting Frequency / Escalation

3 postings on 2026-09-02 through 2026-09-04 alone, with the CCQ double-post signaling an active pressure campaign. This cadence (≈1.4/day) is elevated versus Qilin's baseline and consistent with either a new affiliate cohort onboarding or a successful edge-exploitation harvesting wave.

CVE Correlation (CISA KEV — confirmed ransomware use)

The timing of this wave aligns with the KEV entries below. While leak-site data does not prove vector per victim, the overlap with Qilin's known edge-exploitation playbook is strong:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): Direct perimeter bypass. Qilin's 2024 Check Point credential-harvesting campaign against IKEv1 legacy auth makes this the primary suspected initial access vector for the CA/US government and utility victims.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal / RCE: MSP/RMM pivot vector; a strong candidate for how the LATAM retail and manufacturing victims were reached via their IT providers.
• CVE-2023-21529 — Exchange deserialization (authenticated RCE): Plausible post-access escalation/persistence in the university and government intrusions.
• CVE-2025-60710 — Windows link-following privilege escalation: Consistent with Qilin's SYSTEM-privilege requirement pre-detonation.
• CVE-2026-48027 — Nx Console embedded malicious code: Supply-chain developer-workstation entry; watch for this in orgs with large dev estates.

Assessment: Treat any unpatched Check Point gateway with legacy IKEv1 authentication as actively compromised until proven otherwise if you fall within the targeted sectors.

3. Detection Engineering

Sigma Rules

---
title: Qilin Ransomware - Shadow Copy Deletion and Backup Sabotage
id: 7f3a1b2e-qilin-0001-4a5b-9c6d-202609040001
status: production
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot recovery disabling commonly executed by Qilin/Agenda immediately before encryption detonation.
author: Security Arsenal Threat Intel
date: 2026/09/04
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'delete systemstatebackup'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'shadowcopy delete'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (rare; correlate with change tickets)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: Qilin Ransomware - Lateral Movement via PsExec or WMI Remote Execution
id: 7f3a1b2e-qilin-0002-4a5b-9c6d-202609040002
status: production
description: Detects PsExec service installation and WMI remote process creation consistent with Qilin affiliate payload deployment across the estate prior to mass encryption.
author: Security Arsenal Threat Intel
date: 2026/09/04
logsource:
  product: windows
detection:
  selection_psexec_service:
    - EventID: 7045
      ServiceName|contains:
        - 'PSEXESVC'
        - 'PAExec'
        - 'csexec'
    - EventID: 4697
      ServiceFileName|contains: 'PSEXESVC'
  selection_wmi_remote:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection_psexec_service or selection_wmi_remote
falsepositives:
  - Enterprise software distribution (SCCM); baseline authorized admin hosts
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
---
title: Qilin Ransomware - Rclone Exfiltration to Cloud Storage
id: 7f3a1b2e-qilin-0003-4a5b-9c6d-202609040003
status: production
description: Detects execution of rclone or renamed copies performing data staging/exfiltration to cloud storage, a documented Qilin pre-encryption exfiltration method.
author: Security Arsenal Threat Intel
date: 2026/09/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\rclone.exe'
    OriginalFileName: 'rclone.exe'
  selection_args:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'move '
      - '--config'
      - 'mega'
      - 's3:'
      - 'sftp:'
      - 'webdav'
  condition: selection_name and selection_args
falsepositives:
  - Sanctioned backup tooling using rclone (whitelist known paths/accounts)
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002

KQL — Microsoft Sentinel: Pre-Detonation Staging Hunt

// Qilin pre-ransomware staging hunt: shadow copy deletion, suspicious admin share writes,
// mass service creation, and rclone-style exfil within a 7-day window.
let lookback = 7d;
let SabotageCmds = dynamic(["delete shadows", "resize shadowstorage", "delete catalog", "recoveryenabled no", "ignoreallfailures"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (SabotageCmds)
       or (FileName =~ "rclone.exe" and ProcessCommandLine has_any ("copy", "sync", "--config"))
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe"))
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ReportId;
let AdminShareWrites =
    DeviceEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType == "NamedPipeEvent" or AdditionalFields has "\\\\ADMIN$" or AdditionalFields has "\\\\C$"
    | extend ShareTarget = tostring(AdditionalFields.RemoteDeviceName)
    | project ShareTime=TimeGenerated, DeviceName, ShareTarget, InitiatingProcessFileName;
let ServiceInstalls =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec") or ServiceFileName has_any ("\\Temp\\", "\\Users\\Public\\")
    | project SvcTime=TimeGenerated, Computer, ServiceName, ServiceFileName;
ProcEvents
| union AdminShareWrites, ServiceInstalls
| sort by DeviceName, StagingTime desc
| summarize IndicatorCount = count(), FirstSeen = min(coalesce(StagingTime, ShareTime, SvcTime)), LastSeen = max(coalesce(StagingTime, ShareTime, SvcTime)), Indicators = make_set(strcat(FileName, InitiatingProcessFileName, ServiceName)) by DeviceName
| where IndicatorCount >= 2
| order by IndicatorCount desc;

PowerShell — Rapid Response Triage Script

# Qilin Rapid Triage — run on suspected hosts during initial triage.
# Checks: shadow copies intact, new services (7d), new scheduled tasks (7d),
# exposed RDP, suspicious Temp/Public executables, Check Point-style VPN logins.
$lookback = (Get-Date).AddDays(-7)
$report = [ordered]@{}

Write-Host "[1] Volume Shadow Copies (Qilin deletes these pre-detonation):" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopyCount'] = ($shadows | Measure-Object).Count
if (-not $shadows) { Write-Warning "NO shadow copies present — possible vssadmin sabotage!" }

Write-Host "[2] Services installed in last 7 days (PsExec/payload droppers):" -ForegroundColor Cyan
$report['NewServices'] = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$lookback} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Path';e={$_.Properties[1].Value}}

Write-Host "[3] Scheduled tasks created in last 7 days:" -ForegroundColor Cyan
$report['NewTasks'] = Get-ScheduledTask | Where-Object {$_.Date -gt $lookback} |
  Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions | Select-Object -First 1).Execute}}

Write-Host "[4] RDP exposure check:" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report['RDPEnabled'] = $rdpEnabled; $report['NLAEnabled'] = ($nlaEnabled -eq 1)
if ($rdpEnabled -and $nlaEnabled -ne 1) { Write-Warning "RDP enabled WITHOUT NLA — brute-force risk. Disable or restrict now." }

Write-Host "[5] Executables in user-writable staging dirs:" -ForegroundColor Cyan
$report['StagedBinaries'] = Get-ChildItem "$env:PUBLIC","$env:TEMP","C:\ProgramData" -Recurse -Include *.exe,*.dll,*.ps1 -ErrorAction SilentlyContinue -Depth 2 |
  Where-Object {$_.LastWriteTime -gt $lookback} | Select-Object FullName, LastWriteTime, Length

Write-Host "[6] Recent 4625 failed logons (brute-force indicator):" -ForegroundColor Cyan
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
$report['FailedLogons24h'] = ($fails | Measure-Object).Count
if ($report['FailedLogons24h'] -gt 500) { Write-Warning "High failed-logon volume — possible RDP/VPN brute force in progress." }

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\qilin_triage_$(Get-Date -f 'yyyyMMdd_HHmm').json"
Write-Host "Report written to $env:TEMP — escalate to IR if any warnings fired." -ForegroundColor Green

4. Incident Response Priorities

T-Minus Detection Checklist (BEFORE encryption fires)

• vssadmin delete shadows / bcdedit recoveryenabled no execution on any server — treat as imminent detonation
• New 7045 service installs (PsExec clones) appearing on multiple hosts within minutes — mass deployment phase
• rclone.exe or renamed equivalent spawning from servers with large outbound transfers to MEGA/S3/SFTP
• WMI (WmiPrvSE.exe) spawning cmd/powershell on hosts where no admin is active
• GPO modifications pushing startup scripts or scheduled tasks domain-wide (Qilin's preferred mass-detonation channel)
• EDR/AV agents stopping or drivers loading from C:\Windows\Temp (BYOVD kill phase)
• New VPN local accounts or IKEv1 legacy-auth logins on Check Point gateways outside change windows

Critical Assets Qilin Historically Prioritizes for Exfiltration

1. Legal, HR, and finance file shares (contracts, payroll, PII) — maximum extortion leverage
2. Backup infrastructure (Veeam/CommVault servers and repositories) — encrypted or deleted first
3. Domain controllers — NTDS.dit theft for credential replay and re-entry
4. OT-adjacent jump hosts in utility/energy victims — used as leverage even when OT itself is untouched
5. Email archives / Exchange — negotiation intelligence and secondary extortion material

Containment Actions (Ordered by Urgency)

1. Isolate the Check Point/edge VPN appliance from management networks; force-reset all locally-managed VPN credentials (assumed harvested if CVE-2026-50751 unpatched)
2. Disable PsExec/admin-share lateral paths: block SMB (445) workstation-to-workstation; restrict 445 to approved admin jump hosts
3. Kill active C2: block identified Cobalt Strike/SystemBC egress at the firewall; sinkhole DNS
4. Protect backups NOW: offline/immutable snapshots, rotate backup service credentials, verify restore capability
5. Suspend the compromised AD tier: disable suspected accounts, force krbtgt double-reset if DC compromise confirmed
6. Preserve volatile evidence (memory, VPN logs, event logs) before remediation wipes them — Qilin affiliates routinely clear logs
7. Engage IR retainer and legal/comms before leak-site deadlines — Qilin's staged re-posts (see CCQ) show negotiation windows are actively managed

5. Hardening Recommendations

Immediate (24 hours)

• Patch/upgrade Check Point Security Gateways against CVE-2026-50751 and disable legacy IKEv1 password-only authentication; audit all local VPN accounts created since 2026-06-01 and force password resets
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and audit RMM tooling estate-wide — remove any unauthorized RMM agents (ScreenConnect, AnyDesk, Splashtop not in your inventory = compromise indicator)
• Patch Exchange (CVE-2023-21529) and Windows (CVE-2025-60710) per CISA KEV deadlines
• Block rclone and unsigned exfil utilities via AppLocker/WDAC; alert on any new binary executing from C:\Users\Public, C:\ProgramData, or C:\Windows\Temp
• Enable LSA protection and tamper protection on all EDR agents; alert on vssadmin, bcdedit, wbadmin execution by non-backup service accounts
• Disable RDP from the internet entirely; require VPN + MFA + NLA for any remote administration

Short-Term (2 weeks)

• Tier-0 identity segmentation: dedicated PAWs for DA/backup admin, no Tier-0 logons on member servers — breaks Qilin's GPO-detonation path
• Immutable/offline backup architecture (air-gapped or object-lock) with tested 4-hour restore for crown-jewel systems — directly counters their backup-destruction phase
• GPO change monitoring with automated rollback — Qilin's mass-deployment channel becomes a detection tripwire instead of an attack vector
• Egress filtering and DLP on cloud storage domains (MEGA, anon S3 buckets) — rclone exfil is the last reliable pre-detonation choke point
• SMB lateral-movement segmentation via host firewall policy: deny workstation-to-workstation 445/135/3389 by default
• Deception layer: canary file shares and honey credentials — Qilin affiliates enumerate broadly and trip these reliably during the staging window

Bottom line: Qilin's current wave pairs edge-VPN exploitation with fast, affiliate-driven double extortion against mid-market government, energy, and manufacturing targets. If your Check Point gateway is unpatched for CVE-2026-50751, assume credential compromise and hunt accordingly — the detection content above is tuned to catch this group in the staging window, before the encryptor fires.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub