Qilin Ransomware Archives

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

7Apr

By RBNo Comments

News

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

According to research from Cisco Talos and Trend Micro, threat actors connected to the Qilin and Warlock ransomware operations have been seen exploiting the bring your own vulnerable driver (BYOVD) approach to mute security solutions operating on affected computers. Talos' analysis of Qilin attacks revealed that they use a malicious DLL called "msimg32.dll," which starts a multi-stage infection chain to disable endpoint detection and response (EDR) systems. More than 300 EDR drivers from practically every security vendor on the market can be terminated by the DLL when it is activated via DLL side-loading. According to Talos researchers Takahiro Takeda and Holger Unterbrink, the first stage consists of a PE loader that sets up the execution environment for the EDR killer component. T...

Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim ‘Korean Leaks’ Data Heist

27Nov

By RBNo Comments

News

Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim ‘Korean Leaks’ Data Heist

What has been described as a sophisticated supply chain operation that resulted in the deployment of Qilin ransomware targeted South Korea's financial industry. According to a report shared with The Hacker News by Bitdefender, this operation used Managed Service Provider (MSP) compromise as the initial access vector, combining the capabilities of a significant Ransomware-as-a-Service (RaaS) group, Qilin, with possible involvement from North Korean state-affiliated actors (Moonstone Sleet). The RaaS team demonstrated "explosive growth" in October 2025, claiming over 180 victims, making Qilin one of the most active ransomware operations this year. According to data from NCC Group, the group is accountable for 29% of all ransomware outbreaks. In September 2025, South Korea became th...

Qilin Ransomware Adds “Call Lawyer” Feature to Pressure Victims for Larger Ransoms

23Jun

By RBNo Comments

News

Qilin Ransomware Adds “Call Lawyer” Feature to Pressure Victims for Larger Ransoms

As the cybercrime gang steps up its efforts to fill the gap left by its competitors, the threat actors behind the Qilin ransomware-as-a-service (RaaS) scheme are now providing legal advice for affiliates to increase the pressure on victims to pay up. According to Israeli cybersecurity firm Cybereason, the new tool appears on the affiliate panel as a "Call Lawyer" feature. Given the sudden shutdowns, operational failures, and defacements of once-popular ransomware companies like LockBit, Black Cat, RansomHub, Everest, and BlackLock, the development signifies a newfound rebirth of the e-crime group. Since October 2022, the group—also known as Gold Feather and Water Galura—has been in operation. According to data gathered from ransomware groups' dark web leak websites, Qilin had the...

New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics

25Oct

By RBNo Comments

News

New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics

Researchers studying cybersecurity have found an upgraded variant of the Qilin ransomware that uses more sophisticated techniques to avoid detection. Halcyon, a cybersecurity company, is tracking the new variation under the name Qilin.B. In a report shared with The Hacker News, the Halcyon Research Team noted that Qilin.B now supports AES-256-CTR encryption for systems with AESNI capability, while maintaining Chacha20 for systems without this support. Furthermore, encryption keys are protected using RSA-4096 with OAEP padding, which prevents file decryption using the attacker's private key or stolen seed values read more about New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics. Get up to date on the latest cybersecurity news and enhance your kn...

Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks

18Jul

By RBNo Comments

News

Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks

Microsoft has disclosed that the notorious cybercrime collective known as Scattered Spider has included ransomware strains like Qilin and RansomHub in its repertoire. A threat actor noted for using complex social engineering techniques to compromise targets and create persistence for later exploitation and data theft is called the "Scattered Spider." Additionally, it has a history of using the BlackCat ransomware to attack VMware ESXi servers. It overlaps with activity clusters that are monitored under the names 0ktapus, Octo Tempest, and UNC3944 by the larger cybersecurity community. An important gang member was reportedly detained in Spain last month read more about Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks. Get up to date on the latest cybersecur...