Qilin
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Threat level
CRITICAL
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
DefenseEvasion
- EDRSandBlast
- PCHunter
- PowerTool
- Toshiba power management driver (BYOVD)
- Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
- +2 more
DiscoveryEnum
- Nmap
- Nping
Exfiltration
- EasyUpload.io
- MEGA
LOLBAS
- PowerShell
- PsExec
- WinRM
- fsutil
Networking
- Proxychains
Offsec
- Cobalt Strike
- Evilginx
- Kali Linux
- NetExec
- SystemBC
- +1 more
RMM-Tools
- NetSupport
- ScreenConnect
Indicators of Compromise (IOCs)
IP addresses
7- 176.113.115.97
- 176.113.115.209
- 85.209.11.49
- 31.41.244.100
- 188.119.66.189
- 185.196.10.52
- 64.176.162.76
Get the complete IOC feed
The full IOC database by API, ready for your SIEM or SOAR.
Create free accountNo credit card required · Free API key
Known infrastructure
The following Tor hidden services have been associated with this group:
Sign InQilinDDOS ProtectionQilin blog
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Qilin’s victim list.
risk score · threat categories · sources · age · confidence — in one request