Forest Global Training Partners

Cyber Risks · Cisco Talos

Uncovering Qilin attack methods exposed through multiple cases

Summary: Cisco Talos reports that the Qilin ransomware group, active since around July 2022 and operating as Ransomware-as-a-Service, peaked at 100 leak-site postings in June 2025 with a near-equal figure in August, and every month except January recorded more than 40 cases. In 2025 incidents Talos examined, attackers are assessed with moderate confidence to have used administrative credentials leaked on the dark web to gain VPN access - in one case a VPN with no MFA configured - then ran nltest.exe, net.exe and whoami for reconnaissance, used a batch file to set WDigest UseLogonCredential to 1 and run Mimikatz and SharpDecryptPwd, exfiltrated data to an attacker-controlled SMTP server, and disabled AMSI and EDR before deploying Cobalt Strike Beacon and the ransomware.

What's compelling: Manufacturing accounts for roughly 23% of Qilin's reported cases, and the intrusion path Talos describes ran through a VPN with no multi-factor authentication - one credential leak away from domain-wide access.

Read the original at Cisco Talos ↗

Topics
Malware
Related