Aliases: Agenda, Qilin (often stylized as Qilin.B)
Operational Model: Ransomware-as-a-Service (RaaS). Qilin operates with an affiliate-driven model, recruiting penetration testers to gain initial access in exchange for a cut of the ransom payments. They are distinct for using a Rust-based encryptor, which provides cross-platform capabilities and high resistance to analysis.
Ransom Demands: Highly variable, typically ranging from $500,000 to several million USD, depending on the victim's revenue and the urgency of data restoration. They strictly enforce a "name-and-shame" policy if negotiations fail.
Initial Access Vectors: Historically, Qilin affiliates leverage valid credentials obtained via phishing campaigns or purchased on initial access broker (IAB) forums. However, recent intelligence confirms a heavy reliance on exploiting internet-facing applications, specifically Remote Monitoring and Management (RMM) tools and email servers.
Double Extortion: Standard playbook. The group exfiltrates sensitive data (financial records, employee PII, client databases) prior to encryption. Evidence suggests they use tools like Rclone and Mega for data staging and exfiltration.
Dwell Time: Average dwell time is short, typically between 2 to 4 days. They move rapidly from initial access to lateral movement to minimize the window for detection.
Current Campaign Analysis
Campaign Overview: Based on live data harvested from Qilin's .onion leak site on 2026-05-25, the group is operating at a high velocity, posting 15 victims within a 5-day window (May 20–24).
Sectors Targeted: There is a distinct pivot towards Business Services and Construction, though the Technology sector remains a high-value target.
- Business Services: Alpert Slobin & Rubenstein (Legal), Global Retool Group, WNS Lowery.
- Construction: CJ Architects, ROTO Immobilien.
- Technology: Semgrep (High-profile target).
- Consumer/Manufacturing: Snyder Packaging, Branded Products.
Geographic Concentration: The campaign is heavily focused on Anglosphere nations (US, GB, AU, NZ) with secondary activity in Central Europe (CZ, AT).
Victim Profile: Targets range from mid-market firms (e.g., Vernon & Ginsburg) to established technology entities (e.g., Semgrep). The inclusion of legal and trading firms suggests a focus on organizations where data confidentiality is paramount and downtime is intolerable.
CVE Correlation: The timing of these postings correlates directly with the addition of specific vulnerabilities to the CISA Known Exploited Vulnerabilities (KEV) catalog in early 2026. The targeting of Email/Hosting providers and Tech firms strongly suggests the use of:
- CVE-2025-52691 / CVE-2026-23760 (SmarterMail): Critical for the Business Services victims likely running hosted email solutions.
- CVE-2024-1708 (ConnectWise ScreenConnect): A likely vector for the Technology and Construction sectors relying on MSPs/RMM tools.
Detection Engineering
Sigma Rules
The following rules target the specific CVEs being exploited in this campaign and Qilin's post-exploitation behavior.
title: Potential SmarterMail Authentication Bypass or Exploitation
id: 6c8a7b12-9f3e-4a1d-bc5e-123456789012
description: Detects suspicious URL patterns indicative of SmarterMail authentication bypass (CVE-2026-23760) or file upload exploits (CVE-2025-52691) observed in IIS logs.
status: experimental
date: 2026/05/25
author: Security Arsenal Research
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
category: web
definition:
condition: selection
fields:
- cs_uri_query
- c_ip
falsepositives:
- Unknown
level: critical
tags:
- attack.initial_access
- cve.2026.23760
- cve.2025.52691
- ransomware.qilin
selection:
cs_uri_query|contains:
- 'Services/MailCalendar.asmx'
- 'LiveApp/Calendar/../../../'
cs_method: POST
---
title: ConnectWise ScreenConnect Path Traversal Exploitation
id: d3e4f5a6-7890-123b-cdef-1234567890ab
description: Detects path traversal attempts associated with CVE-2024-1708 on ConnectWise ScreenConnect servers.
status: experimental
date: 2026/05/25
author: Security Arsenal Research
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
category: web
definition:
condition: selection
fields:
- cs_uri_stem
- cs_uri_query
level: critical
tags:
- attack.initial_access
- cve.2024.1708
- ransomware.qilin
selection:
cs_uri_query|contains:
- '..%2f'
- '..\'
cs_uri_stem|contains:
- '/Host'
---
title: Suspicious VSSAdmin Deletion - Qilin Pre-Encryption
id: e5f6g7h8-9012-345c-def6-1234567890cd
description: Detects the deletion of Volume Shadow Copies via vssadmin, a common step for Qilin affiliates to prevent recovery before encryption begins.
status: experimental
date: 2026/05/25
author: Security Arsenal Research
logsource:
category: process_creation
product: windows
definition:
condition: selection
level: high
tags:
- attack.impact
- attack.t1490
- ransomware.qilin
selection:
Image|endswith: '\vssadmin.exe'
CommandLine|contains: 'delete shadows'
KQL (Microsoft Sentinel)
Hunt for lateral movement and potential Qilin staging activity using Sysmon and SecurityEvent data.
// Hunt for unusual SMB file creation (Data Staging) and Scheduled Task creation (Persistence)
let TimeFrame = 1d;
let SuspiciousExtensions = dynamic(['.exe', '.dll', '.ps1', '.bat', '.rar', '.zip']);
union withsource=TableName
(SecurityEvent
| where TimeGenerated > ago(TimeFrame)
| where EventID == 5145 // Share access
| where RelativeTargetName has_any (SuspiciousExtensions)
| project TimeGenerated, Computer, SubjectUserName, IpAddress, ShareName, RelativeTargetName, TableName),
(DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessFileName in ('powershell.exe', 'cmd.exe', 'wmiprvse.exe')
| where FileName has_any (SuspiciousExtensions)
| project TimeGenerated=Timestamp, Computer=DeviceName, SubjectUserName=InitiatingProcessAccountName, IpAddress=InitiatingProcessIPAddress, ShareName=Folderpath, RelativeTargetName=FileName, TableName)
| summarize count() by Computer, IpAddress, bin(TimeGenerated, 15m)
| where count_ > 5 // Threshold for bulk copying
PowerShell - Rapid Response Hardening
This script performs immediate triage checks for exposed RDP, enumerates recent scheduled tasks (persistence), and checks for the presence of suspicious SmarterMail files.
# Qilin Campaign Hardening & Detection Script
# Run as Administrator
Write-Host "[+] Starting Qilin Campaign Triage..." -ForegroundColor Cyan
# 1. Check for RDP Exposure (Port 3389)
Write-Host "[1] Checking for RDP Listeners..." -ForegroundColor Yellow
$rdp = netstat -ano | findstr ":3389" | findstr "LISTENING"
if ($rdp) {
Write-Host "[ALERT] RDP is listening on the following endpoints:" -ForegroundColor Red
$rdp
} else {
Write-Host "[OK] No RDP listeners detected." -ForegroundColor Green
}
# 2. Enumerate Scheduled Tasks created in the last 7 days
Write-Host "[2] Enumerating Scheduled Tasks (Last 7 Days)..." -ForegroundColor Yellow
$dateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $dateCutoff} | ForEach-Object {
$taskInfo = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
Write-Host "[TASK FOUND] $($_.TaskName) - Last Run: $($taskInfo.LastRunTime) - Author: $($_.Author)" -ForegroundColor Red
}
# 3. Check for SmarterMail Webshell Indicators (Simplified)
Write-Host "[3] Checking SmarterMail directories for suspicious uploads..." -ForegroundColor Yellow
$mailPaths = @("C:\Program Files (x86)\SmarterTools\SmarterMail", "C:\Program Files\SmarterTools\SmarterMail")
foreach ($path in $mailPaths) {
if (Test-Path $path) {
Write-Host "[SCANNING] $path" -ForegroundColor Cyan
# Look for recently modified aspx/asmx files
Get-ChildItem -Path $path -Recurse -Include *.aspx, *.asmx, *.ashx |
Where-Object {$_.LastWriteTime -gt $dateCutoff} |
Select-Object FullName, LastWriteTime | Format-Table
}
}
Write-Host "[+] Triage Complete." -ForegroundColor Cyan
---
# Incident Response Priorities
**T-Minus Detection Checklist (Pre-Encryption):**
1. **Web Server Logs:** Immediately grep IIS logs for SmarterMail path traversal strings (`/../`, `%2f`) or ScreenConnect anomalies.
2. **Active Sessions:** Audit active RDP and VPN sessions. Terminate any sessions originating from unexpected geolocations (e.g., AR, CZ if not business-as-usual).
3. **Process Anomalies:** Hunt for `powershell.exe` spawning `vssadmin.exe` or `wbadmin.exe`.
**Critical Assets Prioritized for Exfiltration:**
Based on Qilin's historical leak site data, prioritize the protection of:
* **Legal:** Case files, client privilege communications (e.g., Alpert Slobin & Rubenstein).
* **Financial:** Audit reports, transaction ledgers, tax documents (e.g., ExpoCredit).
* **Source Code:** Proprietary code repositories (e.g., Semgrep).
**Containment Actions (Ordered by Urgency):**
1. **Isolate Mail Servers:** If SmarterMail is present, disconnect from the network immediately but capture a memory dump if possible.
2. **Disable RMM Accounts:** If ConnectWise ScreenConnect is in use, force-reset all admin passwords and enable MFA; consider temporarily disabling the service if suspicious activity is confirmed.
3. **Revoke Kerberos Tickets:** Force a reset of all KRBTGT passwords if lateral movement is suspected.
---
# Hardening Recommendations
**Immediate (24 Hours):**
* **Patch Critical CVEs:** Apply patches for **CVE-2025-52691**, **CVE-2026-23760** (SmarterMail) and **CVE-2024-1708** (ScreenConnect) immediately. These are confirmed active threats.
* **Internet-Facing Exposure:** Ensure RDP (3389), SMB (445), and WinRM (5985/5986) are blocked from the internet via firewall rules.
* **MFA Enforcement:** Enforce FIDO2 or hardware token MFA for all VPN, RMM, and Email administrative accounts.
**Short-Term (2 Weeks):**
* **Network Segmentation:** Move mail servers and RMM management consoles into a dedicated management VLAN with strict egress filtering.
* **Web Application Firewall (WAF):** Deploy or tune WAF rules to specifically block path traversal attempts (`..`, `%2f`) against internal and external mail interfaces.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.