Hunt / qilin

Qilin

S1242 Qilin

342victims, 90d

Nov 7last post

1reports about them

45/52techniques with a rule

0indicators

Who they hit

Unclassified65
Manufacturing64
Professional services35
Technology35
Retail & consumer30
Finance23

US92
DE24
GB21
ES19
??16
IT16

Posted	Victim	Country	Sector
2026-11-07	Acondistec	DE	Manufacturing
2026-11-06	Rotstein & Shiffman	IL	Professional services
2026-11-05	Insurance Audit Services	US	Finance, Insurance
2026-11-05	Calvary Christian College	AU	Education
2026-11-03	Arthur Chapman Kettering Smetak Pikala PA	US	Professional services
2026-11-02	Isapre Consalud	CL	Healthcare
2026-11-02	Astino Berhad	MY	Manufacturing
2026-11-01	fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie	DE	Healthcare
2026-11-01	Global Holding	??	Unclassified
2026-11-01	Shibata Co., Ltd.	JP	Manufacturing
2026-11-01	Meshbesher & Spence	US	Professional services
2026-11-01	BKV Vasúti Jármjavító Kft	HU	Transportation

Latest 12 of 342, from ransomware.live. These are the group's claims.

Confirmed elsewhere

Victims of Qilin that a second, independent source also named inside two weeks. How convergence works.

2026-11-04 The Nueva School leak + notice

Reports about them

2026-10-20 DataBreaches.net: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Also named in passing in 29 more: Unit 42, ReliaQuest, Recorded Future Insikt, ReliaQuest, ReliaQuest, ReliaQuest, Intel 471, ReliaQuest, Cisco Talos, Unit 42, Flashpoint, Group-IB, Unit 42, AhnLab ASEC, Flare, Aqua Nautilus, Recorded Future Insikt, AhnLab ASEC, AhnLab ASEC, Flare, GuidePoint GRIT, Intel 471, AhnLab ASEC, Microsoft Threat Intelligence, Sekoia TDR, Intel 471, Sekoia TDR, Wiz Research, Recorded Future Insikt. Those don't feed the techniques or indicators below.

What they exploit

CVE	Product	KEV	EPSS
CVE-2026-0257	Palo Alto Networks PAN-OS	yes, ransomware use	0.956

What they do

52 techniques, in kill-chain order. 7 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

ID	Technique	Source	SigmaHQ	Status
T1190	Exploit Public-Facing Application	mitre	147	thrunt
T1566.001	Spearphishing Attachment	mitre	24	SigmaHQ
T1566.002	Spearphishing Link	mitre	4	thrunt
T1047	Windows Management Instrumentation	mitre	52	SigmaHQ
T1053.005	Scheduled Task	mitre	51	SigmaHQ
T1059.001	PowerShell	mitre	220	SigmaHQ
T1059.003	Windows Command Shell	mitre	46	SigmaHQ
T1106	Native API	mitre	14	SigmaHQ
T1204.001	Malicious Link	mitre	4	SigmaHQ
T1204.002	Malicious File	mitre	39	SigmaHQ
T1112	Modify Registry	mitre	94	SigmaHQ
T1547.001	Registry Run Keys / Startup Folder	mitre	39	SigmaHQ
T1547.004	Winlogon Helper DLL	mitre	4	SigmaHQ
T1055.001	Dynamic-link Library Injection	mitre	8	SigmaHQ
T1134	Access Token Manipulation	mitre	2	SigmaHQ
T1484.001	Group Policy Modification	mitre	6	SigmaHQ
T1548.002	Bypass User Account Control	mitre	56	SigmaHQ
T1003.001	LSASS Memory	mitre	79	SigmaHQ
T1007	System Service Discovery	mitre	11	SigmaHQ
T1012	Query Registry	mitre	13	SigmaHQ
T1016	System Network Configuration Discovery	mitre	11	SigmaHQ
T1018	Remote System Discovery	mitre	17	SigmaHQ
T1057	Process Discovery	mitre	8	SigmaHQ
T1069.002	Domain Groups	mitre	15	SigmaHQ
T1082	System Information Discovery	mitre	33	SigmaHQ
T1083	File and Directory Discovery	mitre	24	SigmaHQ
T1087.001	Local Account	mitre	13	SigmaHQ
T1087.002	Domain Account	mitre	21	SigmaHQ
T1135	Network Share Discovery	mitre	7	SigmaHQ
T1673	Virtual Machine Discovery	mitre		nothing
T1680	Local Storage Discovery	mitre		nothing
T1021.002	SMB/Windows Admin Shares	mitre	38	SigmaHQ
T1021.004	SSH	mitre	5	SigmaHQ
T1570	Lateral Tool Transfer	mitre	6	SigmaHQ
T1071.002	File Transfer Protocols	mitre	~7	close only
T1219.002	Remote Desktop Software	mitre	46	SigmaHQ
T1486	Data Encrypted for Impact	mitre	16	SigmaHQ
T1489	Service Stop	mitre	20	SigmaHQ
T1490	Inhibit System Recovery	mitre	27	SigmaHQ
T1491.001	Internal Defacement	mitre	4	SigmaHQ
T1529	System Shutdown/Reboot	mitre	8	SigmaHQ
T1027.013	Encrypted/Encoded File	mitre	~94	thrunt
T1036.004	Masquerade Task or Service	mitre	3	SigmaHQ
T1036.005	Match Legitimate Resource Name or Location	mitre	21	thrunt
T1070.004	File Deletion	mitre	15	SigmaHQ
T1222	File and Directory Permissions Modification	mitre	2	SigmaHQ
T1480	Execution Guardrails	mitre		nothing
T1480.002	Mutual Exclusion	mitre		nothing
T1678	Delay Execution	mitre		nothing
T1685	Disable or Modify Tools	mitre	162	SigmaHQ
T1685.005	Clear Windows Event Logs	mitre	8	SigmaHQ
T1688	Safe Mode Boot	mitre		nothing

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1557-claims-kit-single-letter-c2-xenc, t1557-recaptcha-skinned-turnstile-gate, t1190-peoplesoft-psemhub-encoded-path-exploitation, t1566-002-luxembourg-hospitality-sms-phish.

Sweep

No indicators. Either nobody has published any for Qilin, or the reports cite values without marking them as IOCs. package.json