Darktrace Details Network Activity in Qilin Ransomware Cases

Jul 4, 2024 · Original article ↗

Summary

Darktrace analyzed three probable Qilin ransomware cases from 2022–2024, detailing intrusion activity, malware, and data exfiltration across customer networks, including one case with more than 783 GB transferred.

Key points

Darktrace identified three probable Qilin ransomware cases across its customer base between June 2022 and May 2024.
In a June 2022 case, attackers accessed a customer VPN, compromised an administrator account, and moved via RDP to SCCM and VMware ESXi systems; three systems were encrypted.
A 2023 manufacturing-sector compromise involved lateral movement, suspected Cobalt Strike activity, and about 30 GB of data exfiltration to MEGA storage.
In a May 2024 US enterprise case, Darktrace observed suspicious executables, credential abuse, lateral movement, and widespread encryption activity.
That 2024 case involved more than 783 GB of data transferred to 194.165.16[.]13 over non-FTP connections, in addition to more than 102 GB transferred via FTP.
A separate April 2024 investigation showed similar exfiltration infrastructure and activity but no observed ransomware encryption; Darktrace said the similarities may indicate the same actor or affiliate.
Qilin operates as ransomware-as-a-service, and affiliates can use different tactics and infrastructure; Darktrace notes that the cases’ observed indicators may relate to affiliates rather than the group as a whole.

Article Details

Attack Vectors: Previous studies cited in the article report initial access through spear-phishing emails or exposed applications and interfaces; the investigated cases also involved VPN access and compromised administrative accounts.
Observed lateral movement included RDP, SMB, DCE-RPC, and WMI activity, including use of default credentials.
In one case, data was exfiltrated over FTP and other channels; another involved SSL exfiltration to MEGA cloud storage.
Defensive Notes: The article describes detecting unusual scanning, rare external connections, anomalous protocol activity, suspicious file transfers, and large-scale data transfers as useful signals during the investigations.
Darktrace analysts worked with a customer to add affected subnets to monitoring after learning that those subnets had not been monitored during the attack.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`ikea0[.]com`	Listed as a C2 server likely associated with Cobalt Strike.
HOSTNAME	`lebondogicoin[.]com`	Listed as a C2 server likely associated with Cobalt Strike.
IPV4	`184[.]168[.]123[.]219`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]220`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]229`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]230`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]236`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]241`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]246`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]247`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]251`	Listed as possible C2 infrastructure.
IPV4	`184[.]168[.]123[.]252`	Listed as possible C2 infrastructure.
IPV4	`194[.]165[.]16[.]13`	Listed as a probable exfiltration server; observed receiving data over FTP and other connections.
IPV4	`91[.]238[.]181[.]230`	Listed as a C2 server likely associated with Cobalt Strike.
IPV4	`93[.]115[.]25[.]139`	Listed as a C2 server likely associated with SystemBC.