QILIN Ransomware: US & AU Healthcare/Manufacturing Surge — ScreenConnect & Exchange Exploitation

Date: 2026-05-16
Source: Security Arsenal Dark Web Intelligence Unit
Threat Level: CRITICAL

Threat Actor Profile — QILIN

Aliases: Agenda, Qilin.B Affiliation: RaaS (Ransomware-as-a-Service) Ransomware Variant: Rust-based (highly customizable, cross-platform)

Qilin operates a sophisticated RaaS model known for aggressive double-extortion tactics. Unlike affiliates focused purely on speed, Qilin actors often demonstrate moderate dwell times (3–7 days) to perform extensive credential dumping and cloud storage enumeration before detonating encryption.

• Typical Ransom Demands: $500k – $5M USD (negotiable).
• Initial Access Vectors: Heavily reliant on exploiting internet-facing applications (VPN, RDP), specifically targeting unpatched vulnerabilities in remote management software (ScreenConnect) and email gateways (Exchange/SmarterMail). Phishing remains a secondary vector.
• Extortion Strategy: Immediate data leak site posting if contact is not established within 48–72 hours.

Current Campaign Analysis

Sector Targeting

Analysis of the last 100 postings reveals a pivot towards critical infrastructure and supporting industries. The current cluster (15 victims posted between 2026-05-13 and 2026-05-15) shows a distinct concentration in:

1. Manufacturing: 33% of recent victims (e.g., Fab-Masters, Common Part Groupings, NR Engineering).
2. Healthcare: 20% of recent victims (e.g., Generation Life, Spirit Medical Transport).
3. Construction & Transportation: Significant targeting of logistics (Menzies Group) and construction supply chains (Turner Supply).

Geographic Concentration

• United States: 40% of recent victims.
• Australia: 33% of recent victims (Clustered attack observed in AU).
• Others: Germany, Thailand, Philippines, Canada, UK.

Victim Profile

• Company Size: Mid-market enterprises ($50M – $500M revenue).
• Infrastructure: Likely hybrid environments with on-premise Exchange servers or legacy remote access solutions (ScreenConnect) still exposed.

Observed CVEs & Initial Access

This campaign correlates directly with the exploitation of CISA Known Exploited Vulnerabilities (KEVs). Qilin affiliates are actively scanning for:

• CVE-2024-1708 (ConnectWise ScreenConnect): Path traversal leading to RCE. This is a primary vector for the US-based manufacturing victims.
• CVE-2023-21529 (Microsoft Exchange Server): Deserialization RCE. Likely utilized in the AU education and healthcare sectors.
• CVE-2025-52691 / CVE-2026-23760 (SmarterTools SmarterMail): Auth bypass and file upload.

Detection Engineering

SIGMA Rules

---
title: Potential ConnectWise ScreenConnect Exploitation CVE-2024-1708
id: 8b59e832-1c3a-4876-9f5a-7c3b9a4d1e2f
description: Detects suspicious path traversal patterns and webshell-like activity associated with ConnectWise ScreenConnect exploitation.
author: Security Arsenal
status: stable
date: 2026/05/16
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
    product: proxy
detection:
    selection:
        cs-uri-query|contains:
            - '/Web\._resource\.axd?'
            - '\.\./\\\.\./'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: critical
---
title: Microsoft Exchange Deserialization Exploit Attempt CVE-2023-21529
id: a1b2c3d4-5e6f-7890-1234-56789abcdef0
description: Detects potential deserialization attacks on Microsoft Exchange Server via suspicious Exchange PowerShell backend calls.
author: Security Arsenal
status: stable
date: 2026/05/16
logsource:
    product: windows
    service: msexchange-management
detection:
    selection:
        EventID: 6
        Parameter|contains: 'Microsoft.Exchange.Management.SystemConfigurationTasks'
    filter_legit:
        SubjectUserName|endswith: '$'
    condition: selection and not filter_legit
level: high
---
title: Suspicious VSSAdmin Shadow Copy Deletion
id: f4e5d6c7-b8a9-0123-4567-89abcdef012
description: Detects commands used to delete Volume Shadow Copies, a common step in Qilin playbook prior to encryption.
author: Security Arsenal
status: stable
date: 2026/05/16
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\vssadmin.exe'
            - '\\wmic.exe'
    cmdline_keywords:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
    condition: selection and cmdline_keywords
level: critical

KQL (Microsoft Sentinel)

// Hunt for lateral movement and data staging common in Qilin incidents
// Looks for unusual SMB access patterns and PowerShell script block logs
let TimeRange = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeRange)
| where FileName in~ ("powershell.exe", "cmd.exe", "powershell_ise.exe", "psexec.exe", "psexec64.exe")
| where ProcessCommandLine has any("Invoke-AclDumper", "SharpHound", "mimikatz", "procdump", "rasdial")
   or ProcessCommandLine matches regex @"-(?:enc|e|EncodedCommand)\s+[A-Za-z0-9+/=]{50,}"
| extend HostName = DeviceName
| project Timestamp, HostName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

PowerShell Response Script

# Qilin Rapid Response: Check for Persistence and Scheduled Task Anomalies
# Run as Administrator

Write-Host "[+] Checking for recently created suspicious Scheduled Tasks (Last 7 Days)..." -ForegroundColor Cyan

$dateCutoff = (Get-Date).AddDays(-7)
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -ge $dateCutoff }

foreach ($task in $suspiciousTasks) {
    $action = $task.Actions.Execute
    $arg = $task.Actions.Arguments
    
    # Qilin often uses powershell encoded commands in tasks
    if ($action -like "*powershell*" -or $action -like "*cmd*" -or $arg -like "*encoded*") {
        Write-Host "[ALERT] Suspicious Task Found: $($task.TaskName)" -ForegroundColor Red
        Write-Host "   Action: $action $arg" -ForegroundColor Yellow
    }
}

Write-Host "[+] Checking for RDP/ScreenConnect anomalies..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -LocalPort 3389, 8040, 8041 | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | 
    Format-Table -AutoSize


---

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption)

1. ScreenConnect Logs: Review ScreenConnect_[Date].log for path traversal strings (..\..\) or unauthorized Guest login attempts.
2. Exchange IIS Logs: Hunt for POST requests to /ecp/ or /owa/ containing serialized data payloads (high volume, short duration).
3. Process Anomalies: Look for powershell.exe spawning from w3wp.exe (Exchange) or ScreenConnect.Service.exe.
4. Data Exfil: Monitor for massive egress traffic (via bitsadmin or SMB) to non-corporate IP spaces.

Critical Assets at Risk

• Healthcare: PHI databases, PACS imaging archives, patient scheduling systems.
• Manufacturing: CAD designs, intellectual property, ERP systems (SAP/Oracle).

Containment Actions

1. Isolate: Immediately disconnect internet-facing servers hosting Exchange or ScreenConnect from the internal network.
2. Disable Accounts: Suspend service accounts associated with the vulnerable applications.
3. Block IPs: Firewall block on external IPs interacting with CVE exploit paths.

Hardening Recommendations

Immediate (24 Hours)

• Patch CVE-2024-1708: Update ConnectWise ScreenConnect to the latest patched version immediately or block external access to the web interface.
• Patch CVE-2023-21529: Apply Microsoft Exchange Security Updates (SU).
• MFA Enforcement: Enforce phishing-resistant MFA on all remote access (VPN, RDP) and webmail gateways.

Short-term (2 Weeks)

• Network Segmentation: Move Exchange and Remote Access tools into a DMZ with strict egress filtering.
• EDR Deployment: Ensure EDR agents are deployed on all servers, specifically legacy management hosts.
• Audit Admin Rights: Review local administrator group membership on critical servers to remove orphaned accounts.

Related Resources

Security Arsenal Incident Response
Managed SOC & MDR Services
AlertMonitor Threat Detection
From The Dark Side Intel Hub