Uncovering Qilin attack methods exposed through multiple cases
blog.talosintelligence.com/uncoverin…
In the second half of 2025, the ransomware group Qilin has continued to
publish victim information on its leak site at a pace of more than 40 cases
per month, making it one of the most impactful ransomware groups worldwide.
The manufacturing sector has been the most affected, followed by professional
and scientific services, and wholesale trade.
Although this could be a false flag, some of the scripts used by the attacker
contained character encodings that point to Eastern Europe or a
Russian-speaking region.
Talos identified an open-source tool named Cyberduck, which enables file
transfers to cloud servers, among the tools used for data exfiltration. In
recent trends, Cyberduck has been widely abused in cases involving Qilin
ransomware. Artifact logs also show the use of notepad.exe and mspaint.exe,
which were leveraged to view high-sensitivity information.
In Qilin cases, we observed dual deployments: encryptor_1.exe spreads via
PsExec across hosts, while encryptor_2.exe runs from one system to encrypt
multiple network shares.