Qilin

Exploits vulnerabilities in Citrix ADC (CVE-2023-3519), Fortinet devices (CVE-2024-21762, CVE-2024-55591), and exposed RDP services. Spear phishing campaigns deliver malicious attachments while operators leverage brute force attacks, stolen passwords from initial access brokers, and weak credentials.

Additional vectors include cross-system credential spraying, RDP & service account hijacking, and zero-day exploitation of CVE-2025-31324 targeting public-facing Veeam, Citrix, and Fortinet systems.

Maps networks through Active Directory enumeration using PowerShell AD queries, ShareFinder.ps1, BloodHound, and MassSQL to identify domain controllers, backup systems, and critical infrastructure. Angry IP Scanner provides additional network reconnaissance capabilities.

Deploys RMM tools including AnyDesk, TeamViewer, ScreenConnect, and RDP alongside Cobalt Strike C2 and Silver C2 beacons. PowerShell scripts harvest stored Chrome credentials to expand access across compromised environments.

Uses token impersonation and Pass-The-Hash (PTH) techniques while exploiting Microsoft antivirus weaknesses through unpatched service paths and weak GPOs. Deploys Bring Your Own Vulnerable Driver (BYOVD) attacks for DLL sideloading and abuses scheduled tasks running as SYSTEM. The Rust-based variants add complexity to forensic analysis while operators disable security services (T1562).

PowerShell/batch scripts disable Windows Defender while BYOVD attacks using T1068.sys driver bypass security controls. Leverages trusted binaries like certutil.exe, bitsadmin.exe, and powershell.exe for payload delivery while bypassing UAC through legitimate tools with signed certificates. Performs network-wide security policy tampering and manipulates default-admin-REG configurations.

Harvests credentials through keyloggers, memory dumps, and browser stores, focusing on domain administrator privileges. Embedded Mimikatz extracts credentials directly from LSASS process memory for unrestricted network access.

Maintains encrypted communication through C2 infrastructure at 193.106.175.107, 45.134.140.69, and backup servers. QDoor attacks establish persistent Cobalt Strike/Silver beacons for interactive access while preventing traffic inspection.

Spreads via SMB/Admin shares (T1021.002), WinRM, WMI using winrm.exe, PowerShell, and Imppacket's wmiexec.py. PsExec (native & Imppacket's psexec.py) and RDP enable manual operations while legitimate RMM tools blend malicious activity with normal administration.

Steals data using WinSCP, 7-Zip, WinRAR, PowerShell, Rclone + Mega.nz, Google Drive, Dropbox, and HTTPS tunnels via Cobalt Strike/Silver. FTP/WebDAV connections to controlled infrastructure and Bluetooth for air-gapped networks ensure successful data theft before encryption begins.

Establishes multiple backdoors through scheduled tasks (T1053) and boot-time scripts (T1547) across critical systems to survive partial remediation attempts.

Creates severe operational disruption through systematic encryption, particularly devastating for VMware ESXi environments. Utilizes multi-pass encryption technique for enhanced data protection and operational security during encryption processes.

Deploys ChaCha20, AES-256-CTR, or RSA-4096 encryption (T1486) with the Qilin.B variant automatically selecting optimal algorithms. Executes kill processes for data security, creates exclusions for specific modes (normal, step-step, fast, percent), and implements multi-threaded selective encryption with custom extensions. Deployment occurs via admin shares or GPO with self-deletion post-execution.

Demands range from $50,000 to several million with outliers reaching $50 million.

Removes forensic evidence by deleting Volume Shadow Copies (T1490) using vssadmin.exe, disabling restore points, and wiping logs. Prevents safe mode access and implements multi-phase log clearing through PowerShell automation. Maintains continuous forensic evidence removal and event log clearing throughout operations. Self-deleting executables minimize attack traces.