Bleepingcomputer

Investigation into Qilin Ransomware Incident

First seen 2 Dec 2025, 18:33 UTC • Bleepingcomputer

•100% similarity •19.8

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A Qilin ransomware attack has prompted an investigation by security analysts to determine how the attackers gained initial access and the subsequent actions taken. The analysis involves examining logs, antivirus detections, and other clues, although visibility may be limited due to external factors such as incomplete deployment of security agents across endpoints.

ThreatCluster AI

Attack Flow

13 entities, 20 inferred relationships (STIX 2.1).

Technique (5)

Ransomware
T1021.001 - Remote Desktop Protocol
T1059.001 - PowerShell
T1219 - Remote Access Software
T1562.004 - Disable Or Modify Security Tools

Affected Platform (1)

Windows

Threat Actor (2)

Qilin
Qilin Ransomware

Indicator (1)

ba79cdbcbd832a0b1c16928c9e8211781bf536cc

Tool (4)

LogMeIn
PowerShell
S5cmd
ScreenConnect

Relationships

Qilin uses LogMeIn
Qilin uses PowerShell
Qilin uses S5cmd
Qilin uses ScreenConnect
Qilin Ransomware uses LogMeIn
Qilin Ransomware uses PowerShell
Qilin Ransomware uses S5cmd
Qilin Ransomware uses ScreenConnect
Qilin uses Ransomware
Qilin uses T1021.001 - Remote Desktop Protocol
Qilin uses T1059.001 - PowerShell
Qilin uses T1219 - Remote Access Software
Qilin uses T1562.004 - Disable Or Modify Security Tools
Qilin Ransomware uses Ransomware
Qilin Ransomware uses T1021.001 - Remote Desktop Protocol
Qilin Ransomware uses T1059.001 - PowerShell
Qilin Ransomware uses T1219 - Remote Access Software
Qilin Ransomware uses T1562.004 - Disable Or Modify Security Tools
Qilin related to Windows
Qilin related to ba79cdbcbd832a0b1c16928c9e8211781bf536cc

Community

Browse all →

Tracked Entities in This Story

Qilin Qilin Ransomware Windows Ransomware LogMeIn PowerShell S5cmd ScreenConnect

Investigation into Qilin Ransomware Incident

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story