qilin Ransomware
Tracked since Oct 8, 2022
9
victims recorded
9
in the last 30 days
0
CVEs
1d
Last activity
In MITRE ATT&CK MITRE ATT&CK
Ransomware cataloged as Qilin (S1242)
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.003 Phishing: Spearphishing via Service Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.004 Command and Scripting Interpreter: Unix ShellT1569 System ServicesT1569.002 System Services: Service Execution Persistence
T1037 Boot or Logon Initialization ScriptsT1053 Scheduled Task/JobT1053.005 Scheduled Task/Job: Scheduled TaskT1098.004 Account Manipulation: SSH Authorized KeysT1136 Create AccountT1547 Boot or Logon Autostart Execution Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1036.001 Masquerading: Invalid Code SignatureT1134.004 Access Token Manipulation: Parent PID SpoofingT1211 Exploitation for Defense EvasionT1480 Execution GuardrailsT1497.001 Virtualization/Sandbox Evasion: System ChecksT1553.002 Subvert Trust Controls: Code SigningT1562.001 Disable or Modify ToolsT1562.004 Impair Defenses: Disable or Modify System FirewallT1564 Hidden ArtifactsT1564.003 Hidden Artifacts: Hidden Window Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1040 Network SniffingT1110.002 Brute Force: Password CrackingT1555.003 Credentials from Web Browsers Discovery
T1012 Query RegistryT1046 Network Service DiscoveryT1082 System Information DiscoveryT1614 System Location Discovery Lateral Movement
T1021 Remote ServicesT1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1021.004 Remote Services: SSHT1570 Lateral Tool Transfer Collection
T1560.001 Archive Collected Data: Archive via UtilityT1602.002 Network Device Configuration Dump Exfiltration
T1011 Exfiltration Over Other Network MediumT1011.001 Exfiltration Over Other Network Medium: Exfiltration Over BluetoothT1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1001 Data ObfuscationT1001.001 Data Obfuscation: Junk DataT1071.001 Application Layer Protocol: Web ProtocolsT1572 Protocol Tunneling Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1561 Disk WipeT1561.001 Disk Wipe: Disk Content Wipe Resource Development
T1587.001 Develop Capabilities: Malware Reconnaissance
T1590.004 Gather Victim Network Information: Network Topology Observed tools
Credential Theft
Mimikatz
Defense Evasion
EDRSandBlast · PCHunter · PowerTool · Toshiba power management driver (BYOVD) · Updater for Carbon Black’s Cloud Sensor AV (upd.exe) · YDArk · Zemana Anti-Rootkit driver
Discovery Enum
Nmap · Nping
Exfiltration
EasyUpload.io · MEGA
LOLBAS
PowerShell · PsExec · WinRM · fsutil
Networking
Proxychains
Offsec
Cobalt Strike · Evilginx · Kali Linux · NetExec · SystemBC · Tofsee
RMM-Tools
NetSupport · ScreenConnect
Most affected countries (30 days)
- United States4
- Spain1
- Ecuador1
- Mexico1
- Singapore1
Most affected sectors (30 days)
- Professional Services4
- Energy & Utilities2
- Transportation1
- Financial Services1
- Education1
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live