Article
Darkside Ransomware: Caviar Taste on Your Big-Game Budget
Arete Analysis
Summary
Explore Darkside ransomware, an operation utilizing sophisticated tactics to target high-revenue organizations. Arete’s threat intelligence data reveals high ransom demands, extensive business downtime, and universal data exfiltration.
By all appearances, the proprietors of Darkside ransomware mean business.
With their sights set on organizations with US$4M+ in revenue, they’re about high-value, big-game targets and they’ve got the skills and experience to bring in some big hauls.
The Darkside group demonstrates seasoned experience, polished business acumen, and an ability to quickly respond to both negative and positive stimuli within their sphere of market influence. They exhibit similarities to notable ransomware operations, such as LockBit and REvil, and they take an outwardly aggressive posture toward the security industry, taunting companies like BitDefender and Coveware.
Statistical data on Darkside ransomware from Arete engagements
The information below is based on Darkside events that the Arete IR team has investigated since November 2020. Our incident response and data analytics practices work together to track key data points and collect statistics on variants for every ransomware engagement.
Sectors of clients affected by this threat:
Professional Services | Manufacturing
Average Ransom Demand: US $6,527,402.02
Highest Ransom Demand: US $10,054,804
Lowest Ransom Demand: US$3,000,000
Average business downtime: 5 days
Data exfiltration observed in 100 percent of cases
Key observations
Based on the Arete Cyber Threat Intelligence (CTI) team’s assessments:
Darkside ransomware operators are likely conducting long-tail reconnaissance of the victim environment for up to two (2) weeks prior to deploying their payloads.
The earliest known point of malicious activity for a select event was noted when forensic discovery indicated installation of the MetaSploit framework on the victim’s domain controller fifteen (15) days prior to enterprise-wide, automated deployment of Darkside.
Yes, we expect Darkside to be big-game hunters. Forbes quoted them as saying they will target “only those who can afford to pay.” Their recruitment advertisements echo this assertion.
Darkside proprietors and operators come from an established pedigree.
They are transparent in their description of operational mistakes and they renumerate operators for lost revenue.
They taunt BitDefender and Coveware directly with aggressive and forthright assertions of their intent.
As recently as December 27, 2020, a Russian-speaking cybercriminal actor using the handle ‘darksupp’ invited media outlets and data recovery organizations to follow a new “Press Center” section at the Darkside “name-and-shame” leak site. Darksupp allegedly stated that this press center would enable media and recovery firms to ask questions about recent attacks while also giving recovery organizations access to a dedicated chat room, where they could enroll in a “loyalty program” for discounts on data decryption.
The group has underwritten their aspirations with a substantial surety bond (approx. US$350k) and assert that they are willing to increase their guarantee to inspire further confidence in the right partners.
Their first and now exclusive appearance on XSS (reboot of DamageLab) along with exploitation of their endorsements/acceptance from known Russian-speaking actors underpins the Arete CTI team’s current assessment of their maturity and client knowledge.
On November 10, 2020, a Russian-speaking cybercriminal actor using the handle ‘darksupp’ announced the launch of an official recruitment effort for affiliates to participate in the Darkside Ransomware-as-a-Service (RaaS) affiliate program.
Darksupp received a forum-public favorable review on XSS from actor Quake3 (aka LockBit), proprietor of the LockBit RaaS platform.
The proprietor(s) behind the ‘darksupp’ persona tout seasoned experience with and feature influence from notable ransomware operations, such as LockBit and REvil.
Darkside operator affiliates are likely using Whitebit (e.g., Whitebit[.]com) to cash out, given observed wallet transactions and ledger analysis by Arete.
Detailed information
On August 8, 2020, operators of the Darkside ransomware announced their malware in a press release on the dark web. They stated that they had created their ransomware because they could not find the perfect product for their needs and had made millions of dollars by partnering with other well-known ransomware groups. In the same release, they also said they would not be targeting the healthcare, education, non-profit, and government sectors.
On November 11, 2020, Darkside announced their RaaS model, inviting partners and affiliates to work with them. They also announced the development of a distributable data storage system, calling out the use of servers in Iran and unrecognized republics to prevent victim organizations from taking down their operations.
Figure 1. Darkside announces their service.
Figure 2. Darkside announcement of their RaaS product, distributed storage system, and invitation to partners and affiliates to work with them.
After this announcement, multiple news outlets began reporting that the group was using servers in sanctions countries like Iran. In response, the Darkside group updated their storage announcement on November 15, 2020, stating:
The storage system is still in the planning stages and has not yet launched.
They are not citizens of Iran, and leaked company data is not and will not be hosted in Iran.
They are still considering where to host the leaked data, but it would not be in a region on the sanctions list.
Figure 3. Darkside makes an updated announcement, that they will think where to host leaked data on servers that are not in sanctions countries.
The above business model makes total sense from the threat actors’ perspective. If the data were stored on servers in regions on the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) sanctions list, the actors would be unable to obtain ransom payments from victims.
The Arete CTI team and other researchers in the community found that the group has been advertising their services on well-known Russian hacker forums, with posts written in Russian.
Figure 4. Darkside group advertising on a well-known hacking forum (Source: SentinelOne)
Figure 5. A Google translation of Darkside advertisement on a well-known Russian hacking forum (Source: SentinelOne)
Based on language analysis, a native Russian-language speaker wrote the posts. What’s more, the group’s ransomware is designed to avoid infecting systems in Commonwealth of Independent States (CIS) countries, including Russia. In the past, other Eastern European threat actor groups have done the same to try to avoid getting in trouble with local law enforcement agencies. The Arete CTI team also conducted blockchain analysis of previous ransom payments and did not find any ties between sanctioned entities/money service businesses (MSBs) and Darkside money-laundering operations.
As leaders in the community and especially in the current COVID-19 climate, we need to join forces to properly inform the public without causing worldwide panic and help ensure our clients’ quick recovery from attacks and return to normal business operations. If a company were to make a rash decision about ransom payments based on negligent reporting, it could prevent file restoration and ultimately, shutter a business and cost employees their livelihood.
Darkside high-level technical overview
While tactics, techniques, and procedures (TTPs) may vary amongst operators, it’s important to note that Darkside caters to semi-exclusive affiliates, likely of Russian or Eastern European origin. They likely pool their technical experience — both successes and failures — from this exclusive cultural enclave to orchestrate their intrusions and execute on their objective as outlined below:
Darkside ransomware is primarily geared toward Windows systems, however, the proprietor ‘darksupp’ claims the ability to develop payloads that also target Linux OS variants.
We have observed the builder module screens for the control panel, and we are aware of the existence of Linux ELF-executable payloads. We assess this to be true, with high confidence.
Given observed use of MetaSploit and potentially other Offensive Security Tool (OST) frameworks — always contingent on operator/affiliate preference — it’s likely that Darkside ransomware operators leverage these same tools to enumerate vulnerabilities of victim networks, where externally facing systems of interest are exposed, to establish initial access.
We observed actors pivoting from having Administrator RDP sessions on the Domain Controller, to accessing another privileged account to access a file server. Thus, it’s highly likely that their two weeks in the environment afforded them precision-targeting abilities. They took their time hunting.
On November 25, 2020, ‘darksupp’ claimed to have launched a content delivery network (CDN) for storing and delivering compromised data exfiltrated from victims of Darkside ransomware. The actor also claimed to be developing a second version of the ransomware and intends to provide support for distribution using dynamic-link library (.dll) and PowerShell scripts (.ps1) for deployment.
We have observed Darkside operators manually enumerating and exfiltrating data using a combination of RDP access and their own copy of QTBrowser, 7zip. This culminates in a direct upload of files to both PrivatLab and MegaUpload cloud hosting, under cover of Web/HTTPS sessions, which are difficult to sift in many cases for less mature organizations. \
This manual methodical exfiltration occurred over the span of several hours.
7zip archives were named after data/folder names enumerated and temporarily stored in root temp directory (e.g., C:Temp, C:Temp1, C:Temphr{archive}.7z).
We observed Darkside payload (e.g., azure_agent.exe.exe) staged on the domain controller in a network-shareable folder (e.g., C:WindowsIMEazure), followed by the establishment of a scheduled task (e.g., WindowsSYSVOLdomainPolicies{L0NGMGU1D}UserPreferencesScheduledTasks) set with Group Policy and instructing hosts to obtain and execute the payload. This resulted in a fully automated enterprise-wide deployment less than 24 hours after data was exfiltrated.
Security Recommendations
Implement a sophisticated endpoint detection and response (EDR) solution that will rely on behavior analysis — not just malware signatures — and have tamper-proof capabilities.
Implement multifactor authentication (MFA).
Implement an email security solution to detect and protect against known and unknown threats.
Hunt for unusual remote desktop protocol (RDP) connections.
Use Group Policy Software Restriction Policies (SRP) to prevent users from executing Windows executable filetypes (e.g., .exe, .dll, .hta, .bat, .scr) from the AppDataLocalTemp path of Office365, Microsoft Word, Excel, and Outlook. Alternatively, also inspect C:Users[current user]AppDataRoamingMicrosoft as it’s another popular method that achieves the same results.
Implement and regularly test an off-site backup solution.
Appendix
Indicator | Role |
|---|---|
C:\Windows\IME\azure | File path of DC where Darkside payload was staged. |
F:\temp | File path of staged 7zip archives (.7z) prior to exfiltration |
F:\temp1 | File path of staged 7zip archives (.7z) prior to exfiltration |
F:\temphr | File path of staged 7zip archives (.7z) prior to exfiltration |
Windows\SYSVOL\domain\Policies\{LONGMGU1D}\User\Preferences\ScheduledTasks | Path of Scheduled Task on Domain Controller for deployment of Darkside payload via Group Policy. |
Indicator | Role |
|---|---|
azure_agent.exe.exe | Darkside Payload |
README.3a43168b.TXT | Darkside Ransomware Note – README.{random_string}.TXT |
enc.exe | Darkside Payload |
idfoodsf.exe | Darkside Payload |
Indicator | Role |
|---|---|
6d134cdf470f03707ad481b617e67b9018f92f72a0e2fb3e6cc9f2ab17ac1439 | Darkside Payload |
06cfe7f5d88e2f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8 | Darkside Payload |
243dff0fc80a049f4fb3729f8b8def0fce29768f345c88ee1069e22b0ae60 | Darkside Payload |
0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d | Darkside Payload |
Indicator | Role |
|---|---|
www[.]privatelab[.]com | Manual Data Exfiltration – Cloud Upload |
www[.]mega[.]nz | Manual Data Exfiltration – Cloud Upload |
Bitcoin Wallet Address
bc1qkk8z69uxkrxdeuwlkvlk89p7qnr6cefa4aeq7p
Leak Site
hxxps://Darksidedxcftmqa[.]onion
Complete advertisement from the Darkside group on a popular Russian hacking forum (Full translation from Russian to English)
————- [Welcome to Darkside] ————–> Кто мы? ——————————
Мы продукт нацеленный только на крупные корпорации. Можно детальнее прочесть тут: https://www.forbes.com/sites/daveywinder/2020/08/23/beware-of-the-dark-side-a-sinister-new-1-million-cybersecurity-threat-Darkside-ransomware/ https://bbc.com/news/technology-54591761https://www.wired.com/story/ransomware-gone-corporate-Darkside-where-will-it-end/ https://www.bleepingcomputer.com/news/security/Darkside-ransomware-hits-north-american-real-estate-developer/
Кого мы ищем?
——————————
Ограниченное количество стабильных и адекватных партнеров, кто понимает зачем нужно выгружать данные, что такое бэкапы и как их удалять, русскоговорящих, со средними выплатами от 400к. Кого мы НЕ ищем?
——————————
Англоговорящих личностей.
Сомнительных личностей, сотрудников секретной службы и аналитиков ИБ компаний.
Тех, кто ставит дедики и занимается деятельностью отличимой от поставки сетей.
Любые темы и предложения отличимые от этого поста.
Желающих обучиться пентестингу и зарабатывать миллионы.
Любителей ставить 100кк выкупа за 3.5 сервера.
О софте?
——————————
Мы готовы предоставить партнерам:
Windows [full ASM, salsa20 + rsa 1024, i/o, собственная реализация salsa и rsa, fast / auto (улучшенный space) / full, имперсонализация токена для работы с шарами, раб столом, освобождение занятых файлов, изменение прав на файлы, arp scanner, завершения процессов, сервисов, drag-and-drop и много другого].
Linux [C++, chacha20 + rsa 4096, многопоточен (в том числе Hyper-threading, аналог i/o на windows), поддержка урезанных сборок ос (esxi 5.0+), fast / space, настройка каталогов и много другого].
Админ панель [full ajax, автоматический прием Bitcoin, Monero, генерация win / lin билдов с указанием всех параметров (процессы, сервисы, папки, расширения…), отстук ботов и детальная статистика по результативности компании, автоматическое распределение и вывод средств, саб–аккаунты, онлайн чат и множество другого].
Leak site [скрытые посты, поэтапная публикация данных таргета и еще множество функционала].
Все решения уже проверены и доделаны, мы сами работаем своим софтом и не писали его на продажу / аренду, в отличие от многих продуктов.То чего нам не хватало в работе с другими партнерскими программами — мы реализовали у себя.
Правила?
——————————
Следующие сферы запрещены:
– Медицина (Больницы, госпитали).
– Образование (Университеты, школы).
– Государственный сектор (муниципалитеты, любые гос органы).
– Некоммерческие организации (благотворительные фонды, ассоциации).Запрещены любые действия, которые наносят репутационный урон имиджу продукта.
Запрещена любая работа по СНГ (в том числе Грузии, Украине).
Запрещена передача аккаунта третьим лицами.
Какой процент?
——————————
От 25% до 10%. В софте динамическая система рейта. Чем больше выплата, тем меньше % партнерки и наоборот.Так же возможен стабильный рейт, это обсуждается. Как попасть?
——————————
Пройти собеседование, показать свою работу и выплаты, ответить на необходимые вопросы.Но для начала написать в ЛС. При этом указать:
Свой опыт работы.
С какими партнерскими программами работали.
Диапазон сумм выкупа. Минимум, максимум, средняя.
Работаете сами или в команде.
TOX или jabber.
Если вам не ответили, то вы не подошли, спамить в теме не нужно.
Рассматриваем ли мы доступы в сети?
——————————
Да, USA от 400kk, с предложениями можно отписать в ЛС, написав сайт, сферу деятельности компании и контакт. Если компания интересна – с вами свяжутся. Какие гарантии?
——————————
Депозит в 20 BTC (~305k на момент написания) на xss.is. Если у вас будут супер предложения, мы с удовольствием его поднимем, вплоть до 1кк и более.
Translation to English:
Who are we looking for?
——————————
A limited number of stable and adequate partners who understand the importance of exfiltrating data, awareness of backups and how to delete them, Russian-speaking, with average payouts of 400k.
Who are we NOT looking for?
——————————
English-speaking personalities.
Suspicious individuals, employees of the secret service and analysts of information security companies.
Those who only setup RDP access or do other things other than deploy on networks.
Any topics and suggestions different from this post.
Those who want to learn pen-testing and earn millions.
Those who think they can demand US$100M in ransom for 3.5 servers. About software?
——————————
We are ready to provide partners with:
Windows payloads [full ASM (assembly language), I/O, custom implementation of the Salsa20 and RSA-1024 ciphers, fast / automated / full encryption, token impersonation for accessing shared network drives, process termination to encrypt open files, file permission modification, ARP scanning tool, the drag-and-drop UI/UX features, and much more)
Linux payloads [C++, ChaCha20 + RSA-4096, multithreading (including hyper-threading, an analogue of the Windows I/O system), support of stripped-down OS versions (ESXI 5.0 and up), fast [encryption] / space [overwrite], catalog adjustment, and many other things].
Admin panel [ajax, automatic transaction processing for Bitcoin, Monero, generation of Windows/Linux builds with selectable parameters (processes, services, folders, and extensions), bots will report detailed statistics on the company’s performance, ability to create sub-accounts, online chat and much more].
Leak site [ability to hide posts, allows for detailed disclosures of compromised data, and much more]. All solutions have been tested and we work with our own software and did we did not produce it simply for sale/rent, unlike many products. In our program, we’ve implemented everything we wanted, but did not find in other affiliate programs.
Rules?
——————————
The following areas are prohibited:
Healthcare (clinics and hospitals).
Education (universities and schools).
The public sector (municipal services and public agencies).
Non-profit organizations (charitable foundations and associations).
Any actions that can damage the product reputation are prohibited.
Do not target systems in the CIS (this includes Georgia and Ukraine).
Sharing accounts is not allowed.
What’s the percentage/share of profits?
——————————
From 25% to 10%. The software has a dynamic rate system. The higher the payout, the lower the% of the affiliate program and vice versa.
A stable rate is also possible, this is being discussed.
How to get?
——————————
Pass an interview, show your work and payments, answer the necessary questions. First, send us a message. Indicate:
Your previous experience.
What other programs you’ve worked.
Your range of previous closed payments; minimum, maximum, average.
Your preferences on working alone or with a team.
Provide your TOX or Jabber contact.
If we don’t answer you, then you weren’t the right fit, don’t spam us about it in the topic thread. Will we consider network accesses?
——————————
Sure, provided it’s a U.S. company with US$400M+ in revenue.
Solicit your offer for consideration; provide company website, line of business, and your contact details. If we’re interested, we’ll contact you.
What guarantees?
——————————
We made a deposit of 20 BTC (~ 305,000 USD) with forum escrow at XSS. If you make an awesome partnership proposal, we may raise that deposit to 1M+ to instill further confidence.
——————————
Note: Edited for clarity and readability
Back to Blog Posts
Report
Malware Spotlight: Qilin Ransomware
Executive Summary
Over the past few years, Arete’s Incident Response (IR) team has responded to more than one hundred incidents attributed to the Qilin ransomware group. Active since October 2022 under a different name (Agenda), the group had an increase in activity at the beginning of 2025, especially during the second quarter, when it was the most active threat group. Notably, most of its activity came in June 2025, as the group exploited vulnerabilities in Fortinet’s FortiGate appliances and reportedly attempted to recruit ex-RansomHub affiliates. In the first quarter of 2026, the group remained the second most active extortion group behind Akira and actively targeted WatchGuard Firebox devices for initial access, particularly those vulnerable to CVE-2025-14733, a critical vulnerability in WatchGuard Fireware OS that allows a remote, unauthenticated threat actor to execute arbitrary code.
This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Qilin’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses. For more insights and data on Qilin and other top threat groups, explore Arete’s Q1 2026 Crimeware Report.
Incident Response Data on the Qilin Ransomware Group
The information below is based on Arete engagements attributed to Qilin since August 2023. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.
Impacted sectors include professional services, public services, healthcare, financial services, manufacturing, high technology, retail, and hospitality.
The median initial ransom demand is $400,000.
Tools observed during investigations include Mimikatz, Lazagne, FGDump, PsExec, Splashtop, Mesh Agent, Atera, ScreenConnect Client, AnyDesk, SoftPerfect Network Scanner (Netscan), Advanced Port Scanner, WinRAR, WinSCP, FileZilla, Putty, Rclone, and MEGAsync.
Qilin-affiliated actors often exploit edge device vulnerabilities or use legitimate credentials.
The group operates a TOR data leak site (DLS), where it self-identifies as Qilin and commonly threatens to release stolen data if a payment is not made.
The ransom note identifies the group as Qilin and contains links to its data leak and chat negotiation sites. To initiate negotiations, login credentials are included in the ransom note. Part of the ransom note filename matches the encrypted file extension as a naming convention.
In addition to encrypting files and creating a ransom note, the Qilin ransomware requires a password to execute properly, supports various command-line arguments, deletes volume shadow copies, clears the Windows Event Logs, and creates a desktop wallpaper displaying information about the encryption event.
Background
Arete first observed Qilin in incident response engagements in 2023. Over time, the group evolved into an increasingly sophisticated and notable ransomware operation, becoming the top threat group in Q2 of 2025 and the second-most active, after Akira, in Q3 and Q4 of 2025 and Q1 of 2026.
TOP THREAT GROUPS OBSERVED BY QUARTER
Figure 1: Top threat groups observed by Arete by quarter
Qilin impacts a broad range of organizations throughout North America and often lists victims that fail to reach a negotiation agreement on its data leak site. The group maintains Windows and Linux versions of its ransomware, and the most recently observed Windows-based version was developed in the Rust programming language. Qilin has been observed exploiting vulnerabilities in Fortinet appliances as an initial access vector.
In 2025, Qilin broadened its RaaS platform by introducing a “Call Lawyer” negotiation-support feature, through which affiliates can request assistance from individuals that Qilin portrays as an internal legal team when victims delay or resist negotiations. The goal is to provide affiliates with tactics that pressure victims into believing that non-compliance could lead to regulatory scrutiny, fines, or even criminal exposure. Additionally, the platform offers affiliates more aggressive coercion methods, such as launching distributed denial of service (DDoS) attacks against victim websites.
Technical Analysis
Malware analysis revealed that Qilin ransomware:
Supports multiple command-line arguments.
Requires the correct password to fully encrypt files.
Appends a file extension to all encrypted files; however, the extension is not static. Instead, it is randomly generated for each incident. As an example, this report uses the extension XXXXXXXXX (e.g., file.docx.XXXXXXXXX).
Generates a ransom note with a filename that incorporates the same randomized extension value used during encryption. Continuing the example above, the ransom note was named README-RECOVER-XXXXXXXXXX.txt, where XXXXXXXXXX corresponds to the unique extension assigned in this incident.
Self-identifies the group as Qilin in the ransom note.
References a data leak site in the ransom note that, when accessed, also self-identifies the group as Qilin.
Kills a list of processes and services.
Clears Windows event logs.
Maintains a list of whitelisted files and directories to ensure the system does not become unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system's volume shadow copies.
Creates a mutex during execution.
Creates an image file in the %Temp% directory and later modifies a registry key to change the desktop wallpaper.
Creates log files in a QLOG directory created in %TEMP% (e.g., ThreadId(1).LOG).
Has a well-defined ransomware configuration with various fields like company_id, accounts, note, password_hash, directory_black_list, file_ black_list, process_black_list, and file_pattern_black_list.
Execution Pattern/Arguments
Qilin ransomware will not execute in the system without the correct “--password” argument.
Example of the command to run the executable:
Qilin.exe --password XXXXXXXXXXXXX --no-admin |
Screenshot of the ransomware execution in the command prompt with the password argument redacted:
Figure 2. Ransomware execution in command prompt
List commands supported by the Qilin ransomware analyzed:
Command Line Parameters | Description |
|---|---|
--password | Required to start program. Reads password from password.txt. |
--spread | Spreads to Windows hosts using login credentials. Does not encrypt local machine. |
--spread-vcenter | Distributes payload to ESXi/vCenter hosts and installs modules. No local encryption. |
--no-admin | Disables admin rights check. |
--no-priority | Disables CPU and IO priority settings. |
--no-extension | Prevents file extension change during encryption. |
--no-note | Disables ransom note saving in folders. |
--timer | Delays execution by specified seconds. |
--paths | Encrypts only specified paths/directories. |
--ips | Encrypts only network resources on specified IPs or hosts. |
--no-ef | Disables file extension filtering. |
--no-ff | Disables file name/type filtering. |
--no-df | Disables directory filtering. |
--no-proc | Disables process killer functionality. |
--no-services | Disables service killer functionality. |
--no-vm | Disables virtual machine detection and related kills. |
--no-sandbox | Disables sandbox detection logic. |
--kill-cluster | Enables destruction of cluster environments. |
--safe | Reboots to safe mode, enables autologin, and begins encryption. |
--no-autostart | Prevents self-autostart configuration. |
--no-wallpaper | Prevents wallpaper or lockscreen changes. |
--no-destruct | Prevents self-destruction after execution. |
--no-zero | Disables wiping of free disk space post-encryption. |
--no-local | Skips encryption of local volumes. |
--no-mounted | Skips encryption of mounted shares and network shortcuts. |
--no-domain | Skips host discovery in domain networks. |
--no-network | Skips host discovery in the entire subnet. |
--exclude | Skips specified hosts/IPs from encryption and scanning. |
--print-image | Prints a message to all available printers post-encryption. |
--print-delay | Sets delay before printing with --print-image. |
--force | Allows multiple instances by skipping mutex creation. |
--no-logs | Disables writing of log files. |
--logs | Collects and archives logs to local directory. |
--dry-run | Runs encryption simulation without modifying files. |
Stop Services and Processes
Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.
Process names:
vmms, vmwp, vmcompute, agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, sql, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, cagservice, qbidpservice, qbdbmgrn, qbcfmonitorservice, sap, teamviewer_service, teamviewer, tv_w32, tv_x64, cvmountd, cvd, cvfwd, cvods, saphostexec, saposcol, sapstartsrv, avagent, avscc, dellsystemdetect, enterpriseclient, veeamnfssvc, veeamtransportsvc, veeamdeploymentsvc, mvdesktopservice |
Service names:
vmms, mepocs, memtas, veeam, backup, vss, sql, msexchange, sophos, msexchange, msexchange\\$, wsbexchange, pdvfsservice, backupexecvssprovider, backupexecagentaccelerator, backupexecagentbrowser, backupexecdivecimediaservice, backupexecjobengine, backupexecmanagementservice, backupexecrpcservice, gxblr, gxvss, gxclmgrs, gxcvd, gxcimgr, gxmmm, gxvsshwprov, gxfwd, sapservice, sap, sap\\$, sapd\\$, saphostcontrol, saphostexec, qbcfmonitorservice, qbdbmgrn, qbidpservice, acronisagent, veeamnfssvc, veeamdeploymentservice, veeamtransportsvc, mvarmor, mvarmor64, vsnapvss, acrsch2svc, (.*?)sql(.*?) |
File and Directory Exclusions
The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.
Excluded file extensions:
themepack, nls, diapkg, msi, lnk, exe, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs, theme, mpa, nomedia, spl, cpl, adv, icl, msu, XXXXXXXXXX |
Excluded directories:
windows, system volume information, intel, admin$, ipc$, sysvol, netlogon, $windows.~ws, application data, mozilla, program files (x86), program files, $windows.~bt, msocache, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old, appdata, .., ., boot, windows, windows.old, $recycle.bin, admin$ |
Excluded files:
desktop.ini, autorun.ini, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log, autorun.inf, bootmgr, bootmgr.efi, bootmgfw.efi, #recycle, autorun.inf, boot.ini, bootfont.bin, bootmgr, bootmgr.efi, bootmgfw.efi, desktop.ini, iconcache.db, ntldr, ntuser.dat, ntuser.dat.log, ntuser.ini, thumbs.db, #recycle, bootsect.bak |
Inhibit System Recovery
Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.
The ransomware deletes volume shadow copies and disables the Windows Volume Shadow Copy Service (VSS) before file encryption by starting the following processes:
wmic service where name='vss' call ChangeStartMode Manual |
System Network Connections Discovery
Qilin ransomware can enumerate network-mounted shares by scanning the network interfaces.
Data Encrypted for Impact
The ransomware initially finds available drives, then loads the files one by one using the Windows APIs “FindFirstFileW“ and “FindNextFileW”. The ransomware generates random AES keys to encrypt the files, then encrypts the AES keys using a public RSA key. The resulting key is placed at the end of the file.
The ransomware encrypts files, adds a randomized extension to the encrypted files, and appends the following bytes towards the end of each file.
-----END CIPHERTEXT BLOCK----- |
Figure 3. “.XXXXXXXXXX” extension added to the encrypted files
Figure 4. Encrypted file padding bytes followed by encrypted AES keys
Upon successful execution, the ransomware creates a ransom note with the file name README-XXXXXXX-XXXXXXXXXX.txt.
Figure 5. Screenshot showing a portion of the Qilin ransom note
Ransom note content:
-- Qilin Your network/system was encrypted. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Blog links: Data includes: -- Warning 1) If you modify files - our decrypt software won't able to recover data -- Recovery 1) Download tor browser: https://www.torproject[.]org/download/ Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. -- Credentials Extension: XXXXXXXXXX |
Modify Registry
The Windows registry is a database that stores configuration settings and values for the Windows operating system. It manages user preferences, installed software, system configurations, and more. Malware abuses the Windows registry to maintain persistence, hide its presence, disable security settings, and launch malicious scripts.
The QIlin ransomware performs a registry key modification to change the desktop wallpaper.
Registry Key | Value Name | Value Data |
|---|---|---|
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers | BackgroundHistoryPath0 | C:\Users\Akxy\AppData\Local\Temp\jjAJrgQA.jpg |
Figure 6. Screenshot showing the registry modification
Figure 7. Wallpaper image content from the C:\Users\%USERNAME%\AppData\Local\Temp\jjAJrgQA.jpg file
The ransomware performs the following registry key modification to achieve persistence:
Registry Key | Value Name | Value Data |
|---|---|---|
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | *zgngnt | Qilin.exe --password XXXXXXXXXXXXX --no-admin --no-admin |
Figure 8. Screenshot showing the registry modification
Mutex
The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, malware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value: c4eed3e3a7e1114c2864980024a9c68f88e647866a180835afafd5ef80da1afe
Figure 9. Screenshot of the mutex value created while debugging the ransomware
Network Activity
The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.
Indicator Removal
Windows Event Logs keep a record of a computer's alerts and notifications, and the ransomware clears these logs to hide its malicious activity. The following command was executed to clear the logs:
"powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)} |
File and Directory Modification
The ransomware uses the fsutil tool to redirect file system access to a different location after gaining access to compromised networks by executing the following commands:
"cmd" /C fsutil behavior set SymlinkEvaluation R2R:1 |
Indicators of Compromise
Indicator | Type | Context |
|---|---|---|
8d608d85e4785592857988c0cd749881a5e888e49e30b80ea90d214792547135 f910b2a6d84d0677cda9aefabfa4a45863ba51a8831588e3b527e8e1d3a9927c | SHA256 hash | Qilin ransomware |
C:\README-RECOVER-XXXXXXXXXX.txt | File path | Qilin ransom note |
.XXXXXXXXXX | Extension | Encrypted file extension example |
"cmd" /C vssadmin.exe delete shadows /all /quiet | Process | Volume Shadow Copy deletion and disabling of the Volume Shadow Copy (VSS) service |
"powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)} | Process | Clearing Windows event logs |
"cmd" /C fsutil behavior set SymlinkEvaluation R2R:1 | Process | File and directory permissions modification |
Key: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\ Name: BackgroundHistoryPath0 Data: C:\Users\%USERNAME%\AppData\Local\Temp\jjAJrgQA.jpg | Registry | Registry modification to display the Qilin ransomware desktop wallpaper image |
Key: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: *zgngnt Data: "C:\Users\%USERNAME%\Desktop\Qilin.exe" --password XXXXXXXXXXXXX --no-admin --no-admin | Registry | Registry modification to achieve persistence |
http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion | URL | TA data leak site (DLS) |
Ransomware Configuration
=== START EMBEDDED CONFIGURATION === extension_black_list: ["themepack", "nls", "diapkg", "msi", "lnk", "exe", "scr", "bat", "drv", "rtp", "msp", "prf", "msc", "ico", "key", "ocx", "diagcab", "diagcfg", "pdb", "wpx", "hlp", "icns", "rom", "dll", "msstyles", "mod", "ps1", "ics", "hta", "bin", "cmd", "ani", "386", "lock", "cur", "idx", "sys", "com", "deskthemepack", "shs", "theme", "mpa", "nomedia", "spl", "cpl", "adv", "icl", "msu", "XXXXXXXXXX"] extension_white_list: ["mdf", "ldf", "bak", "vib", "vbk", "vbm", "vrb", "vmdk", "abk", "bkz", "sqb", "trn", "backup", "bkup", "old", "tibx", "pfi", "pvhd", "pbf", "dim", "gho", "vpcbackup", "arc", "mtf", "bkf", "dr"] filename_black_list: ["desktop.ini", "autorun.ini", "ntldr", "bootsect.bak", "thumbs.db", "boot.ini", "ntuser.dat", "iconcache.db", "bootfont.bin", "ntuser.ini", "ntuser.dat.log", "autorun.inf", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "#recycle", "autorun.inf", "boot.ini", "bootfont.bin", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "desktop.ini", "iconcache.db", "ntldr", "ntuser.dat", "ntuser.dat.log", "ntuser.ini", "thumbs.db", "#recycle", "bootsect.bak"] directory_black_list: ["windows", "system volume information", "intel", "admin$", "ipc$", "sysvol", "netlogon", "$windows.~ws", "application data", "mozilla", "program files (x86)", "program files", "$windows.~bt", "msocache", "tor browser", "programdata", "boot", "config.msi", "google", "perflogs", "appdata", "windows.old", "appdata", "..", ".", "boot", "windows", "windows.old", "$recycle.bin", "admin$"] win_services_black_list: ["vmms", "mepocs", "memtas", "veeam", "backup", "vss", "sql", "msexchange", "sophos", "msexchange", "msexchange\\$", "wsbexchange", "pdvfsservice", "backupexecvssprovider", "backupexecagentaccelerator", "backupexecagentbrowser", "backupexecdivecimediaservice", "backupexecjobengine", "backupexecmanagementservice", "backupexecrpcservice", "gxblr", "gxvss", "gxclmgrs", "gxcvd", "gxcimgr", "gxmmm", "gxvsshwprov", "gxfwd", "sapservice", "sap", "sap\\$", "sapd\\$", "saphostcontrol", "saphostexec", "qbcfmonitorservice", "qbdbmgrn", "qbidpservice", "acronisagent", "veeamnfssvc", "veeamdeploymentservice", "veeamtransportsvc", "mvarmor", "mvarmor64", "vsnapvss", "acrsch2svc", "(.*?)sql(.*?)"] |
Data Leak Site
The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Qilin:
TOR DLS: ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion
Figure 10. Tor DLS
Detection Mechanisms
Arete Bloktd℠ Rules
Arete Bloktd℠ includes expert threat analysis, crafted threat hunting queries, and active deployment of preventive rules for adversarial behaviors on SentinelOne® protected assets monitored by Arete.
SentinelOne® S1QL 2.0 Query Syntax
Qilin Ransomwareendpoint.os = 'windows' and event.category = 'process' and event.type = 'Process Creation' and src.process.cmdline matches '\\.exe {1,4}--password {1,4}[a-zA-Z0-9-]{32} {1,4}--no-admin' Note: This threat hunting query may need to be tuned for your specific network environment. |
|---|
Yara
rule Qilin_ransomware_executable strings: condition: |
|---|
Recommended Mitigations
Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
Block any known attacker C2s in the firewall.
Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
Eliminate unnecessary RDP ports exposed to the internet.
Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
Perform periodic dark web monitoring to verify if data is available for sale on the black market.
Perform penetration tests.
Periodically patch systems and update tools.
Monitor connections to the network from suspicious locations.
Monitor downloads and uploads of files to file-sharing services outside standard work hours.
Monitor file uploads from domain controllers to the internet.
Monitor network scans from uncommon servers (e.g., RDP server).
Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.
Arete Advisors, LLC makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the contents of this report and expressly disclaims liability for errors and omissions in the content. Neither Arete Advisors, LLC, nor its employees and contractors make any warranty, express or implied or statutory, including but not limited to the warranties of non-infringement of third-party rights, title, and the warranties of merchantability and fitness for a particular purpose, with respect to content available from this report. Arete Advisors, LLC assumes no liability for any direct, indirect, or any other loss or damage of any kind for the accuracy, completely, or usefulness of any information, product, or process disclosed herein, and does not represent that the use of such information, product, or process would not infringe on privately owned rights. Information contained in this report is provided for educational purposes only and should not be considered as legal advice.
Article
Critical Vulnerability in Progress Kemp LoadMaster Exploited
Researchers have identified active exploitation of CVE-2026-8037, a critical unauthenticated remote code execution vulnerability affecting Progress Kemp LoadMaster. The vulnerability affects LoadMaster GA versions 7.2.63.1 and earlier and LTSF versions 7.2.54.17 and earlier and can allow a remote adversary to execute commands on an affected appliance without valid credentials when the vulnerable API is exposed. Progress has released updates addressing CVE-2026-8037 and CVE-2026-33691, a separate Web Application Firewall security control bypass, in GA 7.2.63.2 and LTSF 7.2.54.18.
The exploitation of this vulnerability reflects a broader trend of threat actors targeting internet-facing enterprise technologies. For example, Progress MOVEit Transfer experienced significant scanning and exploitation activity in 2025 involving CVE-2023-34362 and CVE-2023-36934, as well as the 2023 exploitation of CVE-2023-34362 by the Cl0p ransomware group for large-scale data theft and extortion. More recently, CISA confirmed the exploitation of SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, by ransomware groups. Collectively, these incidents demonstrate the continued targeting of perimeter-facing enterprise technologies as high-value entry points into corporate environments.
What’s Notable and Unique
Public exploit research, observed exploitation attempts, and CISA KEV inclusion indicate that CVE-2026-8037 has progressed into an active operational threat, increasing urgency for organizations with exposed and unpatched LoadMaster systems.
Internet-facing infrastructure can be rapidly identified through automated scanning, enabling threat actors to quickly identify vulnerable systems and capitalize on newly disclosed vulnerabilities and publicly available exploit techniques.
Analyst Comments
CVE-2026-8037 is significant not only for its severity but also because it affects infrastructure positioned between the internet and critical enterprise applications. The combination of external exposure, unauthenticated exploitation, and public exploit research lowers the barrier for threat actors seeking initial access, and the broader threat landscape reinforces this concern. The exploitation of Progress MOVEit by Cl0p, continued scanning activity against MOVEit, and recent ransomware exploitation of SonicWall SMA1000 vulnerabilities demonstrate sustained adversarial interest in perimeter-facing enterprise technologies. These incidents indicate that such infrastructure should be treated as high-value assets within enterprise security programs.
Sources
Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity
LoadMaster Critical Security Bulletin – June 2026 – (CVE-2026-8037, CVE-2026-33691)
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
Podcast
Blockchain Unmasked: The Role of Cryptocurrency in Cybercrime and Threat Intelligence
In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.
Article
ClickFix Evolves in Server-Side Polymorphic Malware Delivery Campaigns
The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls.
What’s Notable and Unique
ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain.
To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators.
The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses.
Analyst Comments
ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites.
Sources
The Evolution of ClickFix: From Cleartext to Server Side Polymorphism