Cisco Talos Details Qilin Ransomware Tactics, from VPN Access to Network Encryption
Summary
Cisco Talos analyzes multiple 2025 Qilin incidents, detailing possible VPN access using exposed credentials, credential theft, cloud exfiltration, defense evasion, and ransomware deployment across Windows and virtualized environments.
Key points
- Talos could not confirm one initial access vector, but observed cases where exposed administrative credentials may have been used to access VPNs; one implicated VPN lacked MFA.
- Attackers used credential-harvesting tools, including Mimikatz, and altered the WDigest setting to make plaintext credentials available in memory.
- Stolen data was packaged with WinRAR and exfiltrated through SMTP or Cyberduck transfers to cloud storage; attackers also inspected files with ordinary Windows applications.
- Observed lateral-movement and persistence methods included RDP, PsExec, remote-management tools, administrator-group changes, scheduled tasks, and Run registry entries.
- Talos found attempts to disable security tools, clear event logs, evade analysis, and deploy Cobalt Strike and SystemBC before ransomware execution.
- Qilin.B deployments sometimes used two encryptors: one spread with PsExec and another encrypting multiple network shares; activity could also target ESXi hosts and ClusterStorage.
- Qilin deletes Volume Shadow Copies and targets backup and security services, while leak-site postings exceeded 40 cases in most months covered, peaking at 100 in June 2025.
Article Details
- Attack Vectors
- Talos assessed with moderate confidence that attackers abused administrative credentials leaked on the dark web to access victim VPNs; NTLM authentication attempts preceded successful access in one case, although Talos could not establish a definitive causal link to the exposed credentials.
- In some cases, attackers may have used Group Policy changes to enable RDP access. From a compromised VPN, they connected by RDP to a domain controller and the initially breached host.
- After gaining network access, attackers used commands and tools to enumerate domain controllers, users, privileges, processes, and systems.
- A batch file modified the WDigest setting to retain plaintext logon credentials, then invoked credential-recovery utilities and Mimikatz. Stolen data was consolidated into a file and exfiltrated to an attacker-controlled SMTP server.
- Attackers packaged selected data with WinRAR. Talos observed Cyberduck configured to transfer large files to a Backblaze host; the article describes cloud services as abused for exfiltration.
- Attackers used compromised accounts for access to multiple IP addresses and network shares, changed firewall and RDP settings, added an account to the local administrators group, and created a share exposing the C: drive.
- Multiple remote-access tools were installed before ransomware execution. Talos observed a ScreenConnect connection to an attacker server on port 8880, but could not confirm that the installed RMM tools were used for lateral movement.
- Obfuscated PowerShell was used to disable AMSI and TLS certificate validation and to change Restricted Admin settings. Attackers also attempted to disable EDR using uninstall commands, service stops, dark-kill, and HRSword.
- Before ransomware execution, Talos observed Cobalt Strike loader and SystemBC activity. The Cobalt Strike loader decrypted and executed a Beacon in memory.
- Qilin encryptors were deployed across hosts using PsExec or run from one system to encrypt multiple network shares. The ransomware also enumerated Active Directory and ESXi environments, enabled SSH on ESXi hosts, and executed a binary across identified hosts.
- The ransomware deleted Volume Shadow Copies, created a scheduled task and a Run registry entry for persistence, and encrypted files including those in ClusterStorage subdirectories.
- Defensive Notes
- The implicated VPN in one case had no MFA configured; the article notes that this would allow an attacker with credentials unfettered access. Cisco Duo is cited as an MFA option.
- Talos was unable to confirm a single initial intrusion vector, and the observed temporal association between dark-web credential exposure and later VPN activity does not establish causation.
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz and other credential-recovery utilities were used to obtain passwords and other authentication data.T1018 · Remote System DiscoveryThe appendix lists this ID for remote-system discovery and also associates it with network-service scanning; the article describes reconnaissance using netscan.T1021.001 · Remote Desktop ProtocolAttackers used RDP to connect from a compromised VPN to a domain controller and the initially breached host.T1021.002 · SMB/Windows Admin SharesAttackers accessed network shares and created a share exposing the C: drive; the appendix lists this ID for SMB and Windows administrative-share activity.T1033 · System Owner/User DiscoveryThe article lists this ID for system owner/user discovery; attackers ran whoami to assess privileges.T1046 · Network Service DiscoveryThe appendix lists this ID for network-service discovery and scanning; the article describes reconnaissance using netscan.T1048 · Exfiltration Over Alternative ProtocolThe article lists this ID for exfiltration; pars.vbs sent consolidated stolen data to an attacker-controlled SMTP server.T1053 · Scheduled Task/JobThe ransomware created the TVInstallRestore scheduled task to run at logon.T1057 · Process DiscoveryAttackers used tasklist to enumerate active processes, including explorer.exe.T1059.001 · PowerShellAttackers ran PowerShell commands for reconnaissance, event-log clearing, and enumeration of Active Directory and ESXi environments.T1070.001 · Clear Windows Event LogsMimikatz commands and a ransomware PowerShell command cleared Windows event logs.T1078 · Valid AccountsThe article lists this ID for valid-account use; attackers may have used leaked administrative credentials to access VPNs and compromised accounts for network access.T1082 · System Information DiscoveryThe appendix lists this ID for system-information discovery; the ransomware and its PowerShell commands gathered host and environment information.T1086 · PowerShellThe appendix also lists this ID for PowerShell activity, including commands used for discovery and event-log clearing.T1087.002 · Domain AccountCommands and ransomware-related PowerShell enumerated domain users and groups.T1105 · Ingress Tool TransferThe article lists this ID for ingress tool transfer; the ransomware deployment command copied an encryptor to a remote host, and a binary was uploaded to ESXi hosts.T1110 · Brute ForceThe article lists this ID for repeated NTLM authentication attempts against VPN accounts.T1110.003 · Password SprayingThe appendix associates this ID with password spraying; the article describes numerous NTLM authentication attempts against VPN accounts.T1112 · Modify RegistryAttackers changed registry settings for WDigest, RDP, and Restricted Admin; the ransomware also added a Run registry entry for persistence.T1133 · External Remote ServicesThe article lists this ID for VPN access to victim networks.T1219 · Remote Access ToolsThe article explicitly identifies remote-access software activity and reports traces of AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect.T1222 · File and Directory Permissions ModificationThe appendix lists this ID for file and directory permission changes; attackers created a network share granting Everyone full control.T1222.001 · Windows PermissionsThe appendix lists this Windows sub-technique for permission changes; attackers created a network share granting Everyone full control.T1482 · Domain Trust DiscoveryThe appendix maps domain discovery to this ID; observed commands included nltest /dclist to enumerate domain controllers.T1484.001 · Group Policy ModificationThe article lists this ID for Group Policy modification; attackers may have changed Group Policy to enable RDP, with moderate confidence.T1486 · Data Encrypted for ImpactQilin encrypted files on victim systems and network shares.T1489 · Service StopThe article lists this ID for service stopping; attackers attempted to stop EDR services and the ransomware stopped VSS.T1490 · Inhibit System RecoveryThe ransomware deleted all Volume Shadow Copies.T1537 · Transfer Data to Cloud AccountThe article lists this ID for cloud-account transfer; Cyberduck history showed a Backblaze host configured as the destination for large-file transfers.T1547.001 · Registry Run Keys / Startup FolderThe ransomware added its executable under the Run registry key to execute after reboot.T1562.001 · Disable or Modify ToolsAttackers attempted to disable EDR through uninstall commands, service stops, dark-kill, and HRSword.
People
Threat Actors
Malware
Cobalt Strike BeaconThe Cobalt Strike loader Talos examined decrypts the encrypted payload contained in the .bss section of the binary shown in Figure 16, then deploys and executes the Cobalt Strike Beacon in memory.Qilin.BIn several cases, a variant of Qilin ransomware, known as "Qilin.B", was used.SystemBCis executed, Talos has observed cases in which remote access tools such as Cobalt Strike loader and SystemBC are run. Cobalt Strike was discovered on the compromised host earlier, but it is not clear whether
Vendors
Products
Active DirectoryA PowerShell command is being executed to efficiently retrieve the hostnames of all computers from Active Directory (AD).ESXiFigure 21. Disable-ClusterServices FunctionIt then enumerates all ESXi hosts, changes the root password, and enables SSH access. Finally, it uploads an arbitrary binary to the "/tmp" directory and executes it across allMicrosoft WindowsC:\WINDOWS\system32\whoami.exe /privTeamViewerstored authentication data from multiple client applications — including WinSCP, Navicat, Xmanager, TeamViewer, FileZilla, Foxmail, TortoiseSVN, Google Chrome, RDCMan, and SunLogin, thereby consolidating harvestedvCenterAs part of its PowerShell operation, it establishes a connection to the vCenter server, enumerates all datacenters and clusters within the vCenter environment, and disables HA and DRS in cluster configurations. (see
Tools
AnyDeskthe installed RMM was used for lateral movement, traces of multiple RMM tools were observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows anBypassCredGuard.exethe reg add command, the batch file sequentially invoked netpass.exe, WebBrowserPassView.exe, BypassCredGuard.exe, SharpDecryptPwd, and ultimately Mimikatz. Within the script (see Figure 8), SharpDecryptPwd isChrome Remote DesktopRMM was used for lateral movement, traces of multiple RMM tools were observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows an excerpt of anCobalt StrikeBefore Qilin ransomware is executed, Talos has observed cases in which remote access tools such as Cobalt Strike loader and SystemBC are run. Cobalt Strike was discovered on the compromised host earlier, but it is notCyberduckTalos identified an open-source tool named Cyberduck, which enables file transfers to cloud servers, among the tools used for data exfiltration.dark-killthe sc command. At the same time, attackers have also been observed running open-source tools such as dark-kill and HRSword. The commands below are traces of dark-kill usage. Instead of running in normal user mode,Distant Desktopmovement, traces of multiple RMM tools were observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows an excerpt of an actual ScreenConnectGoToDesktraces of multiple RMM tools were observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows an excerpt of an actual ScreenConnect connection log,HRSwordAt the same time, attackers have also been observed running open-source tools such as dark-kill and HRSword. The commands below are traces of dark-kill usage. Instead of running in normal user mode, dark.sys isMimikatztheft. Although the archive prevented full inspection of every file, its contents suggest use of mimikatz, several password recovery utilities published by NirSoft, and custom script files.netpass.exeAfter executing the reg add command, the batch file sequentially invoked netpass.exe, WebBrowserPassView.exe, BypassCredGuard.exe, SharpDecryptPwd, and ultimately Mimikatz. Within the script (see Figure 8),netscancommand, enumerated active processes such as explorer.exe via the tasklist command, and utilized the netscan tool for further reconnaissance.PsExecIn Qilin cases, we observed dual deployments: encryptor_1.exe spreads via PsExec across hosts, while encryptor_2.exe runs from one system to encrypt multiple network shares.QuickAssistmultiple RMM tools were observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows an excerpt of an actual ScreenConnect connection log, whichScreenConnectwere observed, including AnyDesk, Chrome Remote Desktop, Distant Desktop, GoToDesk, QuickAssist, and ScreenConnect. Figure 13 shows an excerpt of an actual ScreenConnect connection log, which indicates thatSharpDecryptPwdthe batch file sequentially invoked netpass.exe, WebBrowserPassView.exe, BypassCredGuard.exe, SharpDecryptPwd, and ultimately Mimikatz. Within the script (see Figure 8), SharpDecryptPwd is configured to extract,WebBrowserPassView.exeAfter executing the reg add command, the batch file sequentially invoked netpass.exe, WebBrowserPassView.exe, BypassCredGuard.exe, SharpDecryptPwd, and ultimately Mimikatz. Within the script (see Figure 8),WinRAROnce collected, WinRAR packaged the targeted data, and in some cases the archives were exfiltrated using open-source software. Below are the actual arguments used to run WinRAR.exe. The WinRAR command is configured to
Countries
CanadaCurrent reporting indicates that the countries most severely affected include the United States, followed by Canada, the United Kingdom, France, and Germany.FranceCurrent reporting indicates that the countries most severely affected include the United States, followed by Canada, the United Kingdom, France, and Germany.GermanyCurrent reporting indicates that the countries most severely affected include the United States, followed by Canada, the United Kingdom, France, and Germany.United KingdomCurrent reporting indicates that the countries most severely affected include the United States, followed by Canada, the United Kingdom, France, and Germany.United StatesCurrent reporting indicates that the countries most severely affected include the United States, followed by Canada, the United Kingdom, France, and Germany.
Industries
ConstructionIn the mid-range, several key sectors that form part of social infrastructure-healthcare, construction, retail, education, and finance-each report similar levels of impact, averaging around 5%.EducationIn the mid-range, several key sectors that form part of social infrastructure-healthcare, construction, retail, education, and finance-each report similar levels of impact, averaging around 5%.financeIn the mid-range, several key sectors that form part of social infrastructure-healthcare, construction, retail, education, and finance-each report similar levels of impact, averaging around 5%.HealthcareIn the mid-range, several key sectors that form part of social infrastructure-healthcare, construction, retail, education, and finance-each report similar levels of impact, averaging around 5%.ManufacturingThe manufacturing sector has been the most affected, followed by professional and scientific services, and wholesale trade.Primary industriesAt the lower end, sectors such as services and primary industries show relatively fewer incidents, remaining below 2% on average.Professional and scientific servicesThe manufacturing sector has been the most affected, followed by professional and scientific services, and wholesale trade.RetailIn the mid-range, several key sectors that form part of social infrastructure-healthcare, construction, retail, education, and finance-each report similar levels of impact, averaging around 5%.ServicesThe manufacturing sector has been the most affected, followed by professional and scientific services, and wholesale trade.Wholesale tradeThe manufacturing sector has been the most affected, followed by professional and scientific services, and wholesale trade.