Qilin

How Qilin typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Qilin.

1. T1190 Exploit Public-Facing Application Initial Access

   What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.

   What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

2. T1566.001 Spearphishing Attachment Initial Access

   What they do: Qilin has been delivered to victims through malicious email attachments.

   What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

3. T1566.002 Spearphishing Link Initial Access

   What they do: Qilin has been delivered via malicious links in spearphishing emails.

   What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

4. T1047 Windows Management Instrumentation Execution

   What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

5. T1053.005 Scheduled Task ExecutionPersistencePrivilege Escalation

   What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.

   What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

6. T1059.001 PowerShell Execution

   What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

7. T1059.003 Windows Command Shell Execution

   What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.

   What that means: Adversaries may abuse the Windows command shell for execution.

8. T1106 Native API Execution

   What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

9. T1204.001 Malicious Link Execution

   What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.

   What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.

10. T1204.002 Malicious File Execution

    What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.

    What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.

11. T1112 Modify Registry PersistenceDefense Impairment

    What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.

    What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

12. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

    What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.

    What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

13. T1547.004 Winlogon Helper DLL PersistencePrivilege Escalation

    What they do: Qilin can configure a Winlogon registry entry.

    What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.

14. T1055.001 Dynamic-link Library Injection Privilege EscalationStealth

    What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.

    What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

15. T1134 Access Token Manipulation Privilege EscalationStealth

    What they do: Qilin can use an embedded Mimikatz module for token manipulation.

    What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

16. T1484.001 Group Policy Modification Privilege EscalationDefense Impairment

    What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.

    What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

17. T1548.002 Bypass User Account Control Privilege Escalation

    What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.

    What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

18. T1027.013 Encrypted/Encoded File Stealth

    What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.

    What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

19. T1036.004 Masquerade Task or Service Stealth

    What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.

    What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

20. T1036.005 Match Legitimate Resource Name or Location Stealth

    What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.

    What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

21. T1070.004 File Deletion Stealth

    What they do: Qilin can delete itself from infected hosts after execution.

    What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

22. T1480 Execution Guardrails Stealth

    What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.

    What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

23. T1480.002 Mutual Exclusion Stealth

    What they do: Qilin can create a mutex to ensure only one instance is running.

    What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

24. T1678 Delay Execution Stealth

    What they do: Qilin has the ability to delay execution.

    What that means: Adversaries may employ various time-based methods to evade detection and analysis.

25. T1222 File and Directory Permissions Modification Defense Impairment

    What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.

    What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

26. T1685 Disable or Modify Tools Defense Impairment

    What they do: Qilin can terminate antivirus-related processes and services.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

27. T1685.005 Clear Windows Event Logs Defense Impairment

    What they do: Qilin has the ability to clear Windows Event Logs.

    What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

28. T1688 Safe Mode Boot Defense Impairment

    What they do: Qilin can reboot targeted systems in safe mode to avoid detection.

    What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.

29. T1003.001 LSASS Memory Credential Access

    What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.

    What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

30. T1007 System Service Discovery Discovery

    What they do: Qilin can identify specific services for termination or to be left running at execution.

    What that means: Adversaries may try to gather information about registered local system services.

31. T1012 Query Registry Discovery

    What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

    What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

32. T1016 System Network Configuration Discovery Discovery

    What they do: Qilin can accept a command line argument identifying specific IPs.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

33. T1018 Remote System Discovery Discovery

    What they do: Qilin can enumerate domain-connected hosts during its discovery phase.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

34. T1057 Process Discovery Discovery

    What they do: Qilin can define specific processes to be terminated or left alone at execution.

    What that means: Adversaries may attempt to get information about running processes on a system.

35. T1069.002 Domain Groups Discovery

    What they do: Qilin can run PowerShell cmdlets to discover domain groups.

    What that means: Adversaries may attempt to find domain-level groups and permission settings.

36. T1082 System Information Discovery Discovery

    What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

37. T1083 File and Directory Discovery Discovery

    What they do: Qilin can exclude specific directories and files from encryption.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

38. T1087.001 Local Account Discovery

    What they do: Qilin can list all local users found on a targeted system.

    What that means: Adversaries may attempt to get a listing of local system accounts.

39. T1087.002 Domain Account Discovery

    What they do: Qilin can use PowerShell cmdlets to enumerate domain users.

    What that means: Adversaries may attempt to get a listing of domain accounts.

40. T1135 Network Share Discovery Discovery

    What they do: Qilin has the ability to list network drives.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

41. T1673 Virtual Machine Discovery Discovery

    What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.

    What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.

42. T1680 Local Storage Discovery Discovery

    What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

43. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

44. T1021.004 SSH Lateral Movement

    What they do: Qilin can enable SSH access on ESXi hosts.

    What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).

45. T1570 Lateral Tool Transfer Lateral Movement

    What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.

    What that means: Adversaries may transfer tools or other files between systems in a compromised environment.

46. T1071.002 File Transfer Protocols Command and Control

    What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.

    What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

47. T1219.002 Remote Desktop Software Command and Control

    What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.

    What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.

48. T1486 Data Encrypted for Impact Impact

    What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

49. T1489 Service Stop Impact

    What they do: Qilin can terminate specific services on compromised hosts.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

50. T1490 Inhibit System Recovery Impact

    What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

51. T1491.001 Internal Defacement Impact

    What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.

    What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

52. T1529 System Shutdown/Reboot Impact

    What they do: Qilin can initiate a reboot of the backup server to hinder recovery.

    What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.

The note this group leaves on a compromised machine. Click a filename to read it.

-- Qilin 


We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week.


Your network/system was encrypted. 

Encrypted files have new extension. 


-- Compromising and sensitive data 


We have downloaded compromising and sensitive data from your system/network.

Our group cooperates with the mass media.

If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/)


Blog links:

http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion

http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion


Data includes: 

- Employees personal data, CVs, DL , SSN. 

- Complete network map including credentials for local and remote services. 

- Financial information including clients data, bills, budgets, annual reports, bank statements. 

- Complete datagrams/schemas/drawings for manufacturing in solidworks format 

- And more... 


-- Warning 


1) If you modify files - our decrypt software won't able to recover data 

2) If you use third party software - you can damage/modify files (see item 1) 

3) You need cipher key / our decrypt software to restore you files. 

4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. 


-- Recovery 


1) Download tor browser: https://www.torproject.org/download/ 

2) Go to domain 

3) Enter credentials


Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. 

All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note.

-- Credentials 

Extension: 2ir53sQQAU 
Domain: [snip] 
login: [snip] 
password:[snip]

-- Qilin 


Your network/system was encrypted. 

Encrypted files have new extension. 


-- Compromising and sensitive data 


We have downloaded compromising and sensitive data from you system/network 

If you refuse to communicate with us and we do not come to an agreement, your data will be published. 

Data includes: 

- Employees personal data, CVs, DL , SSN. 

- Complete network map including credentials for local and remote services. 

- Financial information including clients data, bills, budgets, annual reports, bank statements. 

- Complete datagrams/schemas/drawings for manufacturing in solidworks format 

- And more... 


-- Warning 


1) If you modify files - our decrypt software won't able to recover data 

2) If you use third party software - you can damage/modify files (see item 1) 

3) You need cipher key / our decrypt software to restore you files. 

4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. 


-- Recovery 


1) Download tor browser: https://www.torproject.org/download/ 

2) Go to domain 

3) Enter credentials-- Credentials 

Extension: [snip] 
Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion 
login: [snip] 
password:[snip]

-- Agenda

Your network/system was encrypted.
Encrypted files have new extension.

-- Compromising and sensitive data

We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
    - Employees personal dataCVsDLSSN.
    - Complete network map including credentials for local and remote services.
    - Financial information including clients databillsbudgetsannual reportsbank statements.
    - Complete datagrams/schemas/drawings for manufacturing in solidworks format
    - And more...

-- Warning

1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.

-- Recovery

1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials


-- Credentials

Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip] 
password: [snip]

Ransom-note text from RansomLook, licensed CC BY 4.0.