QILIN Ransomware Gang: Global Campaign Targets Manufacturing & Finance — Exchange & Firewall Exploits Detected

---
title: Potential Exploitation CVE-2023-21529 Microsoft Exchange Deserialization
id: 3e8a5f1c-9d2b-4b5c-8e1d-2f3a4b5c6d7e
description: Detects suspicious deserialization activity indicative of CVE-2023-21529 exploitation on Microsoft Exchange.
status: experimental
author: Security Arsenal
date: 2026/04/25
tags:
    - attack.initial_access
    - cve.2023.21529
    - detection.emerging_threats
logsource:
    product: windows
    service: msexchange-management
detection:
    selection:
        EventID: 4 # Management Log event
        Level: 'Error'
        Message|contains:
            - 'System.Runtime.Serialization'
            - 'ObjectStateFormatter'
            - 'LosFormatter'
    condition: selection
falsepositives:
    - Rare legitimate deserialization errors in legacy integrations
level: high
---
title: SmarterMail Authentication Bypass and File Upload Exploitation
id: 7f9e0d1a-2c3b-4d5e-8f9a-0b1c2d3e4f5g
description: Detects exploitation attempts for CVE-2026-23760 and CVE-2025-52691 against SmarterMail instances.
status: experimental
author: Security Arsenal
date: 2026/04/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: webserver
    service: iis
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/Services/MailBoxService.asmx'
            - '/Runtime/ExecuteScript.aspx'
    selection_method:
        cs-method: 'POST'
    selection_status:
        sc-status: 200
    condition: all of selection_
falsepositives:
    - Unknown
level: critical
---
title: Qilin Ransomware Process Execution Characteristics
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects process execution patterns consistent with Qilin Rust-based encryptor and typical lateral movement tools.
status: experimental
author: Security Arsenal
date: 2026/04/25
tags:
    - attack.execution
    - attack.impact
logsource:
    product: windows
    category: process_creation
detection:
    selection_ransom:
        Image|endswith: '.exe'
        Company|contains: 'Unknown'
        CommandLine|contains:
            - '--procmem'
            - '--force'
    selection_lateral:
        - Image|endswith:
              - '\psexec.exe'
              - '\wmic.exe'
          CommandLine|contains: 'node_and_share'
    condition: 1 of selection_*
falsepositives:
    - Legitimate admin use of PsExec/WMIC
level: high


**KQL Hunt (Microsoft Sentinel)**
kql
// Hunt for lateral movement and staging indicators associated with Qilin
let TimeFrame = 2d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
// Look for PowerShell download cradles often used in staging
| where ProcessCommandLine has "powershell" and (
    ProcessCommandLine has "DownloadString" or 
    ProcessCommandLine has "IEX" or
    ProcessCommandLine has "Invoke-WebRequest"
)
// Filter for suspicious parent processes or lack thereof
| where InitiatingProcessFileName !in ("explorer.exe", "cmd.exe", "powershell.exe")
| join kind=inner ( 
    DeviceNetworkEvents 
    | where Timestamp >= ago(TimeFrame) 
    // Hunt for large data egress (Exfil)
    | where SentBytes > 10000000 
    | summarize TotalSentBytes=sum(SentBytes) by DeviceId, RemoteUrl 
) on DeviceId 
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, RemoteUrl, TotalSentBytes
| order by Timestamp desc


**PowerShell Response Script**
powershell
# Qilin Rapid Response: Persistence and Exposure Check
Write-Host "[+] Initiating Qilin Response Hardening Checks..." -ForegroundColor Cyan

# 1. Check RDP Exposure (Common Initial Access)
$RDPProperty = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($RDPProperty.fDenyTSConnections -eq 0) {
    Write-Host "[ALERT] RDP is ENABLED. Qilin frequently brute-forces RDP." -ForegroundColor Red
    # Disable RDP (Remediation)
    # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1
} else {
    Write-Host "[PASS] RDP is Disabled." -ForegroundColor Green
}

# 2. Check for Suspicious Scheduled Tasks (Persistence)
$Tasks = Get-ScheduledTask | Where-Object { $_.State -eq "Ready" -and $_.Author -notlike "*Microsoft*" -and $_.Author -notlike "*System*" }
Write-Host "[+] Checking for non-standard scheduled tasks..." -ForegroundColor Cyan
foreach ($Task in $Tasks) {
    $Action = $Task.Actions.Execute
    if ($Action -like "*powershell*" -or $Action -like "*cmd*" -or $Action -like "*.exe") {
        Write-Host "[SUSPICIOUS] Task: $($Task.TaskName) | Author: $($Task.Author) | Action: $Action" -ForegroundColor Yellow
    }
}

# 3. Check Volume Shadow Copy Status (Pre-Encryption)
$VSSAdmin = vssadmin list shadows 2>&1
if ($VSSAdmin -like "*No shadow copies found*" -or $VSSAdmin -eq $null) {
    Write-Host "[WARNING] No Shadow Copies found. Ensure they haven't been deleted." -ForegroundColor DarkYellow
} else {
    Write-Host "[PASS] Shadow Copies exist." -ForegroundColor Green
}


---