Tag: qilin

8 Attack Reports | 0 Vulnerabilities

Attack reports

Uncovering Qilin attack methods exposed through multiple cases

The ransomware group Qilin has been highly active in 2025, publishing over 40 victim cases per month on its leak site. Manufacturing, professional services, and wholesale trade are the most affected sectors. Attackers likely originate from Eastern Europe or Russian-speaking regions. They use tools …
ransomware
cobalt strike
qilin
systembc
manufacturing
2025-10-27
Published: October 27, 2025
Downloadable IOCs: 17

The Evolution of Qilin RaaS

Qilin ransomware is used for domain-wide encryption, and a ransom is then demanded for the decryption keys and/or to prevent the publication of the stolen data. Qilin affiliates are recruited from cybercrime forums to use the Qilin RaaS platform, which handles payload generation, the publication of…
phishing
ransomware
bitcoin
qilin
ryuk
raas
tor
supply chain attack
nova
2025-10-08
onion
fin12
alphvblackcat
kela
agenda
wikileaks
Published: October 8, 2025
Downloadable IOCs: 5

Shared secret: EDR killer in the kill chain

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors,…
ransomware
edr
ransomhub
compromise
blacksuit
qilin
dragonforce
medusalocker
driver
heartcrypt
lynx
avkiller
2025-08-07
inc
crytox
threat-sharing
Published: August 7, 2025
Downloadable IOCs: 56

Qilin Ransomware and the Hidden Dangers of BYOVD

This analysis examines a recent incident involving Qilin ransomware, highlighting the evolving tactics of cybercriminals to evade Endpoint Detection and Response (EDR) systems. The attackers utilized a previously unknown driver, TPwSav.sys, to disable EDR measures through a technique known as bring…
ransomware
qilin
byovd
raas
2025-07-31
Published: July 31, 2025
Downloadable IOCs: 7

Know thyself, know thy environment

This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also high…
ransomware
qilin
critical infrastructure
pathwiper
2025-06-12
patch management
environment knowledge
gps vulnerabilities
self-awareness
vulnerability disclosure
Published: June 12, 2025
Downloadable IOCs: 0

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

In January 2025, a Managed Service Provider administrator was targeted by a sophisticated phishing attack impersonating a ScreenConnect authentication alert. The attackers, affiliated with Qilin ransomware and tracked as STAC4365, used an adversary-in-the-middle technique to bypass multi-factor aut…
screenconnect
phishing
ransomware
supply chain
mfa bypass
qilin
CVE-2023-27532
2025-04-01
evilginx
stac4365
msp
Published: April 1, 2025
Downloadable IOCs: 0

Analyzing Recent Cyber Attacks in the United States Coinciding with Columbus Day Celebration

The United States has experienced a significant increase in cyber attacks from June to October 2024, with over 800 organizations affected by ransomware across various sectors. Play, RansomHub, Lockbit, Qilin, and Meow have emerged as the most active ransomware groups. Notable incidents include the …
espionage
ransomware
lockbit
hacktivism
ransomhub
qilin
data breach
2024-10-10
rhysida
critical infrastructure
united states
Published: October 10, 2024
Downloadable IOCs: 0

Ransomware: Activity Levels Remain High Despite Disruption

While overall activity levels dipped slightly in the first quarter of 2024, the number of claimed attacks remained high, with LockBit accounting for over 20%. The report explores the changing tactics employed by ransomware actors, including the exploitation of vulnerabilities, the use of Bring-Your…
ransomware
lockbit
vulnerability
blackcat
alphv
encryption
phobos
cyclops blink
CVE-2024-4577
noberus
tellyouthepass
blacksuit
2024-07-11
akira
warp av killer
qilin
disruption
Published: July 11, 2024
Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)
Downloadable IOCs: 27
Click here to see more Attack Reports