Article
Surtr Ransomware Pays Tribute to REvil
Combating Ransomware
Arete Analysis
Summary
Surtr ransomware, a significant threat in the current cyber landscape, paid tribute to the now defunct REvil (aka Sodinokibi) group through its sophisticated techniques, although the developers of Surtr ransomware likely do not have a direct connection to REvil.
In February 2022, Arete investigated a Surtr ransomware incident where the ransomware author(s) paid tribute to the now defunct REvil (aka Sodinokibi) group by making a registry key change to the infected host. REvil was an infamous Russian-speaking Ransomware-as-a-Service (RaaS) operation known for the Kaseya attack. In October 2021, a multinational effort disrupted REvil’s operations, followed by Romanian and Russian law enforcement largely dismantling the group by arresting individuals and seizing millions in cash and cryptocurrency.
Arete notes that the developers of Surtr ransomware likely do not have a direct connection to the now defunct REvil ransomware group. However, it is likely that the developers of Surtr are leveraging their REvil tribute to gain popularity. Arete also notes that multiple ransomware groups and affiliates work in a closed ecosystem, sharing source code, strategies, initial access brokers, functionality, and development resources. Thus, it is possible a Surtr developer previously worked with the REvil ransomware group.
Research revealed that Surtr ransomware
Changes the victim’s system manufacturer name with a sentence paying tribute to REvil.
Uses a message box to warn affiliates not to run the malware in the Commonwealth of Independent States (CIS) — a group of countries in Eastern Europe and Asia formed by Russia and other republics after the dissolution of the Soviet Union — or they will be banned.
Displays messages not common on mature ransomware, which could indicate that the ransomware’s development is still in the early stages.
Like other ransomware, encrypts files in network shares, deletes volume shadow copies, clears Windows event logs, and has a list of whitelisted file extensions, file names, and folders.
Has multilayer obfuscation.
Creates persistence through registry key changes to start as a service, in registry run keys, and make a copy of itself in the StartUp directory.
Creates a mutex value to prevent another copy of the process from running in the system.
Background
Surtr is a new RaaS operation, first observed in December 2021. Like many other ransomware groups, Surtr avoids its execution in the CIS countries and adopts the double extortion scheme of stealing and threatening to leak data if ransom demands are not met. In this investigation, the ransomware targeted Windows systems and employed several anti-debugging/anti-sandboxing techniques. At present, there are no public decryptors or logical flaws to recover files encrypted by Surtr.
Technical Analysis
Surtr ransomware is packed and has an entropy value of 7.62115. The malware has multilayer obfuscation. The native Windows Application Programming Interface (API) “CryptDecrypt” unpacks the first layer of packed content. The packer used Microsoft Enhanced RSA and Advanced Encryption Standard (AES) Cryptographic Provider (CALG_AES_256) to decrypt the data. The unpacked sample is once again UPX packed, which drops the actual payload.
Figure 1. Decrypt function
Figure 2. Decrypting PE file in the memory (encrypted vs decrypted)
Upon decrypting the Portable Executable (PE) file, the packer spawns the same as a new child process with the original packed executable name. Using Windows API “VirtualAllocEx”, it allocates an address space in the spawned child process and writes the process memory with newly decoded binary, later resuming the child process.
Figure 3. Process injection
The decrypted sample shown in Figure 2 is UPX packed. Upon successful unpacking, the analyst gets the Surtr ransomware payload.
Surtr ransomware retrieves file attributes for a specified file or directory “NoRunAnyWay”. If the file or directory does not exist, the program continues creating a folder “Service” at “%ProgramData%”. Later, the sample checks for “config.txt” at the same directory. It appears the ransomware stores its configuration at the “C:\ProgramData\Services” folder at a later point in time.
The ransomware tries to open a mutex by the name “SurtrMUTEX”. If the mutex does not exist, it continues the execution or the ransomware terminates the current program. This activity ensures that a single instance of the program is running.
Figure 4. Creating Mutex
Similar to other ransomware, Surtr avoids execution in the CIS countries, which include Armenia, Azerbaijan, Belarus, Kazakhstan, Kirghizstan, Moldavia, Uzbekistan, Russia, Tajikistan, Turkmenistan, Ukraine, to avoid infecting users where the operators and affiliates most likely reside and visit to prevent arrest by local authorities. Initially, the sample checks the IP address of the victim’s machine and collects IP-related information using ip-api[.]com, which returns a JSON file containing the country of IP origin. Later, this is compared against the list of countries hardcoded in the sample. If there is a match, it avoids execution, leaving a comment “WARNING. Surtr does not run in this country if you do it again you will be banned.” Note: The ransomware also works without proper response from the ip-api[.]com.
Here is the list of countries the ransomware avoids:
Figure 5. Comparing CIS name to avoid execution
Ransomware anti-sandboxing techniques are shown below
The ransomware keeps track of anti-sandboxing techniques using a counter. As shown below, the sample initially checks for API Hooks “E9” for the Windows function “CreateProcessA”. The counter is updated accordingly.
Figure 6. Anti-Sandbox-1
The ransomware checks if the total physical memory (RAM) of the host machine is less than 500MB using the API “GlobalMemoryStatus”. If the victim’s hardware passes this check, the counter is incremented.
Later, using DeviceIOControl, the ransomware gets the geometry (File size) of the C:\ drive and compares it with a hardcoded constant. If the victim’s hardware passes this check, the counter is incremented.[1]
Figure 7. Anti-Sandbox-2, 3
Ransomware anti-debugging techniques are shown below.
Initially, the ransomware checks if any hardware breakpoints (DR0, DR1, DR2, DR3) are set. If the condition satisfies the debugging, the counter is incremented.
Figure 8. Anti-Debugging-1
It also leverages the Windows API “IsDebuggerPresent” to check if the process is being debugged or not and updates the counter accordingly.
Figure 9. Anti-Debugging-2
It appears the program accesses the “Configuration Directory” itself and checks if “GlobalFlagsClear” is set to 0. If yes, the counter is updated.
Figure 10. Anti-Debugging-3
The ransomware checks for the NtGlobalFlag value of the Process Environment Block, which is set to the default value “0” by the operating system. When debugging the malware with a software debugger, the NTGlobalFlag value would be set to 0x70. Passing this check would indicate the presence of a debugger and the counter would be updated [2].
Figure 11. Anti-Debugging-4
Upon these checks, the ransomware compares these calculated individual counters of anti-debugging/anti-sandboxing with the value 2. If either of these counters is more than 2, the ransomware exits with a message box saying, “WARNING. SandBox/Debugger Detected!!!”
The key characteristic of the program is using multithreading for file encryption. Arete observed that multiple threads were created during the execution process, which delays malware analysis and hastens data encryption.
The program makes sure to remove system backups, shadow copies, and system logs.
Figure 12. Removing system backups, Shadowcopies, System logs.
As part of the initial encryption process, the ransomware creates and assigns a random ID to the victim’s machine. The ID is later stored in “c:\ProgramData\Services\ID.surt” and used in further file encryption.
Figure 13: Creating victim ransomware ID
The ransomware checks mounted drives from (A to Z) using Windows native API “GetDriveTypeW”. Once the ransomware enumerates all mounted drives and shares, it encrypts all files except the following:
File Extensions: “.exe”, “.DLL”, “.lnk”, “.surt”
File Names: “surt”, “NTUSER.DAT”, “WIN.INI”, “UsrClass.dat”, “Pagefile.sys”, “hiberfil.sys”, “DumpStack.log.tmp”, “Config.msi”, “boot”
Folders: “Windows”, “Microsoft”, “Windows.old”, “Windows kits”, “WindowsApps”, “Tor Browser”, “Google”, “Mozilla”, “DropBox”
The ransomware uses the “net use” command to connect the remote host device’s share “ADMIN$”. If the connection is successful, the share is added to the encryption list.
Figure 14. Enumerating network shares
The ransomware acquires a targeted file’s handle. Later, it generates a 64-bit random value using a Windows Native API “CryptGenRandom” as shown in Figure 15.
Figure 15. Generating 64-bit random value
The generated random value creates XOR keys, which are used to further encrypt the file contents. Upon encryption of the file, the ransomware encrypts the generated random value using asymmetric encryption and stores the encrypted key at the end of the file as shown in Figure 17.
Figure 16. File encryption loop
Figure 17. Dissecting encrypted file
Figure 17.1 “SURTR” – The attacker identifies if the file was encrypted by the Surtr ransomware using the keyword.
Figure 17.2 Asymmetric encrypted 64-bit random generated values.
Figure 17.3 Delimiter.
The ransomware achieves persistence by copying itself to the “StartUp” folder, creating scheduled tasks that execute the ransomware “ONLOGON” and adding a registry value in “Run” and “RunOnce” key to make the ransomware restart on a system reboot.
Figure 18. Achieving persistence
Arete found that the threat actor also updates the system manufacturer name to “Tribute to the REvil <3” by adding/modifying the “OEMInformation” registry value.
Figure 19. Adding “Tribute to REvil” registry entry
The registry changes mentioned above are shown below.
Figure 20. Updating the system manufacturer
The ransomware further tries to hide by updating its file attributes, thus complicating forensic investigations to identify the same.
Figure 21. Updating file attributes
Upon successful execution of the ransomware, Surtr changes the background of the victim’s machine as shown below and reboots the system.
Figure 22. Changes desktop background
Ransom note name: SURTR_README.hta, SURTR_README.txt.
Figure 23. Ransomware note
Conclusion
A new ransomware on the scene, Surtr could be one to keep an eye on as it mentions REvil’s name in its operations. As more information unfolds, Arete could assess the future of Surtr ransomware. Arete has countermeasures coverage to detect Surtr payloads and artifacts via Arsenal Threat Management and Threat-ID.
Countermeasure
Yara Rule
rule Surtr_ransomware_executable
IOCs:
MD5 Sample B7966CCA3C6FE9B9C64D772EC7DF804C Packed
460FDD0198A286067211BFCF47825B11 UPX Packed
FD16AC037269708C1AB135653483E891 Payload
URL 2i74xfkhsu4zd6qv5aiifv3wznj6vq3jo6mle3zxux6vpftyuezxhmad[.]onion
References:
Back to Blog Posts
Report
Malware Spotlight: Qilin Ransomware
Executive Summary
Over the past few years, Arete’s Incident Response (IR) team has responded to more than one hundred incidents attributed to the Qilin ransomware group. Active since October 2022 under a different name (Agenda), the group had an increase in activity at the beginning of 2025, especially during the second quarter, when it was the most active threat group. Notably, most of its activity came in June 2025, as the group exploited vulnerabilities in Fortinet’s FortiGate appliances and reportedly attempted to recruit ex-RansomHub affiliates. In the first quarter of 2026, the group remained the second most active extortion group behind Akira and actively targeted WatchGuard Firebox devices for initial access, particularly those vulnerable to CVE-2025-14733, a critical vulnerability in WatchGuard Fireware OS that allows a remote, unauthenticated threat actor to execute arbitrary code.
This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Qilin’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses. For more insights and data on Qilin and other top threat groups, explore Arete’s Q1 2026 Crimeware Report.
Incident Response Data on the Qilin Ransomware Group
The information below is based on Arete engagements attributed to Qilin since August 2023. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.
Impacted sectors include professional services, public services, healthcare, financial services, manufacturing, high technology, retail, and hospitality.
The median initial ransom demand is $400,000.
Tools observed during investigations include Mimikatz, Lazagne, FGDump, PsExec, Splashtop, Mesh Agent, Atera, ScreenConnect Client, AnyDesk, SoftPerfect Network Scanner (Netscan), Advanced Port Scanner, WinRAR, WinSCP, FileZilla, Putty, Rclone, and MEGAsync.
Qilin-affiliated actors often exploit edge device vulnerabilities or use legitimate credentials.
The group operates a TOR data leak site (DLS), where it self-identifies as Qilin and commonly threatens to release stolen data if a payment is not made.
The ransom note identifies the group as Qilin and contains links to its data leak and chat negotiation sites. To initiate negotiations, login credentials are included in the ransom note. Part of the ransom note filename matches the encrypted file extension as a naming convention.
In addition to encrypting files and creating a ransom note, the Qilin ransomware requires a password to execute properly, supports various command-line arguments, deletes volume shadow copies, clears the Windows Event Logs, and creates a desktop wallpaper displaying information about the encryption event.
Background
Arete first observed Qilin in incident response engagements in 2023. Over time, the group evolved into an increasingly sophisticated and notable ransomware operation, becoming the top threat group in Q2 of 2025 and the second-most active, after Akira, in Q3 and Q4 of 2025 and Q1 of 2026.
TOP THREAT GROUPS OBSERVED BY QUARTER
Figure 1: Top threat groups observed by Arete by quarter
Qilin impacts a broad range of organizations throughout North America and often lists victims that fail to reach a negotiation agreement on its data leak site. The group maintains Windows and Linux versions of its ransomware, and the most recently observed Windows-based version was developed in the Rust programming language. Qilin has been observed exploiting vulnerabilities in Fortinet appliances as an initial access vector.
In 2025, Qilin broadened its RaaS platform by introducing a “Call Lawyer” negotiation-support feature, through which affiliates can request assistance from individuals that Qilin portrays as an internal legal team when victims delay or resist negotiations. The goal is to provide affiliates with tactics that pressure victims into believing that non-compliance could lead to regulatory scrutiny, fines, or even criminal exposure. Additionally, the platform offers affiliates more aggressive coercion methods, such as launching distributed denial of service (DDoS) attacks against victim websites.
Technical Analysis
Malware analysis revealed that Qilin ransomware:
Supports multiple command-line arguments.
Requires the correct password to fully encrypt files.
Appends a file extension to all encrypted files; however, the extension is not static. Instead, it is randomly generated for each incident. As an example, this report uses the extension XXXXXXXXX (e.g., file.docx.XXXXXXXXX).
Generates a ransom note with a filename that incorporates the same randomized extension value used during encryption. Continuing the example above, the ransom note was named README-RECOVER-XXXXXXXXXX.txt, where XXXXXXXXXX corresponds to the unique extension assigned in this incident.
Self-identifies the group as Qilin in the ransom note.
References a data leak site in the ransom note that, when accessed, also self-identifies the group as Qilin.
Kills a list of processes and services.
Clears Windows event logs.
Maintains a list of whitelisted files and directories to ensure the system does not become unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system's volume shadow copies.
Creates a mutex during execution.
Creates an image file in the %Temp% directory and later modifies a registry key to change the desktop wallpaper.
Creates log files in a QLOG directory created in %TEMP% (e.g., ThreadId(1).LOG).
Has a well-defined ransomware configuration with various fields like company_id, accounts, note, password_hash, directory_black_list, file_ black_list, process_black_list, and file_pattern_black_list.
Execution Pattern/Arguments
Qilin ransomware will not execute in the system without the correct “--password” argument.
Example of the command to run the executable:
Qilin.exe --password XXXXXXXXXXXXX --no-admin |
Screenshot of the ransomware execution in the command prompt with the password argument redacted:
Figure 2. Ransomware execution in command prompt
List commands supported by the Qilin ransomware analyzed:
Command Line Parameters | Description |
|---|---|
--password | Required to start program. Reads password from password.txt. |
--spread | Spreads to Windows hosts using login credentials. Does not encrypt local machine. |
--spread-vcenter | Distributes payload to ESXi/vCenter hosts and installs modules. No local encryption. |
--no-admin | Disables admin rights check. |
--no-priority | Disables CPU and IO priority settings. |
--no-extension | Prevents file extension change during encryption. |
--no-note | Disables ransom note saving in folders. |
--timer | Delays execution by specified seconds. |
--paths | Encrypts only specified paths/directories. |
--ips | Encrypts only network resources on specified IPs or hosts. |
--no-ef | Disables file extension filtering. |
--no-ff | Disables file name/type filtering. |
--no-df | Disables directory filtering. |
--no-proc | Disables process killer functionality. |
--no-services | Disables service killer functionality. |
--no-vm | Disables virtual machine detection and related kills. |
--no-sandbox | Disables sandbox detection logic. |
--kill-cluster | Enables destruction of cluster environments. |
--safe | Reboots to safe mode, enables autologin, and begins encryption. |
--no-autostart | Prevents self-autostart configuration. |
--no-wallpaper | Prevents wallpaper or lockscreen changes. |
--no-destruct | Prevents self-destruction after execution. |
--no-zero | Disables wiping of free disk space post-encryption. |
--no-local | Skips encryption of local volumes. |
--no-mounted | Skips encryption of mounted shares and network shortcuts. |
--no-domain | Skips host discovery in domain networks. |
--no-network | Skips host discovery in the entire subnet. |
--exclude | Skips specified hosts/IPs from encryption and scanning. |
--print-image | Prints a message to all available printers post-encryption. |
--print-delay | Sets delay before printing with --print-image. |
--force | Allows multiple instances by skipping mutex creation. |
--no-logs | Disables writing of log files. |
--logs | Collects and archives logs to local directory. |
--dry-run | Runs encryption simulation without modifying files. |
Stop Services and Processes
Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.
Process names:
vmms, vmwp, vmcompute, agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, sql, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, cagservice, qbidpservice, qbdbmgrn, qbcfmonitorservice, sap, teamviewer_service, teamviewer, tv_w32, tv_x64, cvmountd, cvd, cvfwd, cvods, saphostexec, saposcol, sapstartsrv, avagent, avscc, dellsystemdetect, enterpriseclient, veeamnfssvc, veeamtransportsvc, veeamdeploymentsvc, mvdesktopservice |
Service names:
vmms, mepocs, memtas, veeam, backup, vss, sql, msexchange, sophos, msexchange, msexchange\\$, wsbexchange, pdvfsservice, backupexecvssprovider, backupexecagentaccelerator, backupexecagentbrowser, backupexecdivecimediaservice, backupexecjobengine, backupexecmanagementservice, backupexecrpcservice, gxblr, gxvss, gxclmgrs, gxcvd, gxcimgr, gxmmm, gxvsshwprov, gxfwd, sapservice, sap, sap\\$, sapd\\$, saphostcontrol, saphostexec, qbcfmonitorservice, qbdbmgrn, qbidpservice, acronisagent, veeamnfssvc, veeamdeploymentservice, veeamtransportsvc, mvarmor, mvarmor64, vsnapvss, acrsch2svc, (.*?)sql(.*?) |
File and Directory Exclusions
The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.
Excluded file extensions:
themepack, nls, diapkg, msi, lnk, exe, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs, theme, mpa, nomedia, spl, cpl, adv, icl, msu, XXXXXXXXXX |
Excluded directories:
windows, system volume information, intel, admin$, ipc$, sysvol, netlogon, $windows.~ws, application data, mozilla, program files (x86), program files, $windows.~bt, msocache, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old, appdata, .., ., boot, windows, windows.old, $recycle.bin, admin$ |
Excluded files:
desktop.ini, autorun.ini, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log, autorun.inf, bootmgr, bootmgr.efi, bootmgfw.efi, #recycle, autorun.inf, boot.ini, bootfont.bin, bootmgr, bootmgr.efi, bootmgfw.efi, desktop.ini, iconcache.db, ntldr, ntuser.dat, ntuser.dat.log, ntuser.ini, thumbs.db, #recycle, bootsect.bak |
Inhibit System Recovery
Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.
The ransomware deletes volume shadow copies and disables the Windows Volume Shadow Copy Service (VSS) before file encryption by starting the following processes:
wmic service where name='vss' call ChangeStartMode Manual |
System Network Connections Discovery
Qilin ransomware can enumerate network-mounted shares by scanning the network interfaces.
Data Encrypted for Impact
The ransomware initially finds available drives, then loads the files one by one using the Windows APIs “FindFirstFileW“ and “FindNextFileW”. The ransomware generates random AES keys to encrypt the files, then encrypts the AES keys using a public RSA key. The resulting key is placed at the end of the file.
The ransomware encrypts files, adds a randomized extension to the encrypted files, and appends the following bytes towards the end of each file.
-----END CIPHERTEXT BLOCK----- |
Figure 3. “.XXXXXXXXXX” extension added to the encrypted files
Figure 4. Encrypted file padding bytes followed by encrypted AES keys
Upon successful execution, the ransomware creates a ransom note with the file name README-XXXXXXX-XXXXXXXXXX.txt.
Figure 5. Screenshot showing a portion of the Qilin ransom note
Ransom note content:
-- Qilin Your network/system was encrypted. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Blog links: Data includes: -- Warning 1) If you modify files - our decrypt software won't able to recover data -- Recovery 1) Download tor browser: https://www.torproject[.]org/download/ Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. -- Credentials Extension: XXXXXXXXXX |
Modify Registry
The Windows registry is a database that stores configuration settings and values for the Windows operating system. It manages user preferences, installed software, system configurations, and more. Malware abuses the Windows registry to maintain persistence, hide its presence, disable security settings, and launch malicious scripts.
The QIlin ransomware performs a registry key modification to change the desktop wallpaper.
Registry Key | Value Name | Value Data |
|---|---|---|
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers | BackgroundHistoryPath0 | C:\Users\Akxy\AppData\Local\Temp\jjAJrgQA.jpg |
Figure 6. Screenshot showing the registry modification
Figure 7. Wallpaper image content from the C:\Users\%USERNAME%\AppData\Local\Temp\jjAJrgQA.jpg file
The ransomware performs the following registry key modification to achieve persistence:
Registry Key | Value Name | Value Data |
|---|---|---|
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | *zgngnt | Qilin.exe --password XXXXXXXXXXXXX --no-admin --no-admin |
Figure 8. Screenshot showing the registry modification
Mutex
The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, malware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value: c4eed3e3a7e1114c2864980024a9c68f88e647866a180835afafd5ef80da1afe
Figure 9. Screenshot of the mutex value created while debugging the ransomware
Network Activity
The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.
Indicator Removal
Windows Event Logs keep a record of a computer's alerts and notifications, and the ransomware clears these logs to hide its malicious activity. The following command was executed to clear the logs:
"powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)} |
File and Directory Modification
The ransomware uses the fsutil tool to redirect file system access to a different location after gaining access to compromised networks by executing the following commands:
"cmd" /C fsutil behavior set SymlinkEvaluation R2R:1 |
Indicators of Compromise
Indicator | Type | Context |
|---|---|---|
8d608d85e4785592857988c0cd749881a5e888e49e30b80ea90d214792547135 f910b2a6d84d0677cda9aefabfa4a45863ba51a8831588e3b527e8e1d3a9927c | SHA256 hash | Qilin ransomware |
C:\README-RECOVER-XXXXXXXXXX.txt | File path | Qilin ransom note |
.XXXXXXXXXX | Extension | Encrypted file extension example |
"cmd" /C vssadmin.exe delete shadows /all /quiet | Process | Volume Shadow Copy deletion and disabling of the Volume Shadow Copy (VSS) service |
"powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)} | Process | Clearing Windows event logs |
"cmd" /C fsutil behavior set SymlinkEvaluation R2R:1 | Process | File and directory permissions modification |
Key: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\ Name: BackgroundHistoryPath0 Data: C:\Users\%USERNAME%\AppData\Local\Temp\jjAJrgQA.jpg | Registry | Registry modification to display the Qilin ransomware desktop wallpaper image |
Key: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: *zgngnt Data: "C:\Users\%USERNAME%\Desktop\Qilin.exe" --password XXXXXXXXXXXXX --no-admin --no-admin | Registry | Registry modification to achieve persistence |
http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion | URL | TA data leak site (DLS) |
Ransomware Configuration
=== START EMBEDDED CONFIGURATION === extension_black_list: ["themepack", "nls", "diapkg", "msi", "lnk", "exe", "scr", "bat", "drv", "rtp", "msp", "prf", "msc", "ico", "key", "ocx", "diagcab", "diagcfg", "pdb", "wpx", "hlp", "icns", "rom", "dll", "msstyles", "mod", "ps1", "ics", "hta", "bin", "cmd", "ani", "386", "lock", "cur", "idx", "sys", "com", "deskthemepack", "shs", "theme", "mpa", "nomedia", "spl", "cpl", "adv", "icl", "msu", "XXXXXXXXXX"] extension_white_list: ["mdf", "ldf", "bak", "vib", "vbk", "vbm", "vrb", "vmdk", "abk", "bkz", "sqb", "trn", "backup", "bkup", "old", "tibx", "pfi", "pvhd", "pbf", "dim", "gho", "vpcbackup", "arc", "mtf", "bkf", "dr"] filename_black_list: ["desktop.ini", "autorun.ini", "ntldr", "bootsect.bak", "thumbs.db", "boot.ini", "ntuser.dat", "iconcache.db", "bootfont.bin", "ntuser.ini", "ntuser.dat.log", "autorun.inf", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "#recycle", "autorun.inf", "boot.ini", "bootfont.bin", "bootmgr", "bootmgr.efi", "bootmgfw.efi", "desktop.ini", "iconcache.db", "ntldr", "ntuser.dat", "ntuser.dat.log", "ntuser.ini", "thumbs.db", "#recycle", "bootsect.bak"] directory_black_list: ["windows", "system volume information", "intel", "admin$", "ipc$", "sysvol", "netlogon", "$windows.~ws", "application data", "mozilla", "program files (x86)", "program files", "$windows.~bt", "msocache", "tor browser", "programdata", "boot", "config.msi", "google", "perflogs", "appdata", "windows.old", "appdata", "..", ".", "boot", "windows", "windows.old", "$recycle.bin", "admin$"] win_services_black_list: ["vmms", "mepocs", "memtas", "veeam", "backup", "vss", "sql", "msexchange", "sophos", "msexchange", "msexchange\\$", "wsbexchange", "pdvfsservice", "backupexecvssprovider", "backupexecagentaccelerator", "backupexecagentbrowser", "backupexecdivecimediaservice", "backupexecjobengine", "backupexecmanagementservice", "backupexecrpcservice", "gxblr", "gxvss", "gxclmgrs", "gxcvd", "gxcimgr", "gxmmm", "gxvsshwprov", "gxfwd", "sapservice", "sap", "sap\\$", "sapd\\$", "saphostcontrol", "saphostexec", "qbcfmonitorservice", "qbdbmgrn", "qbidpservice", "acronisagent", "veeamnfssvc", "veeamdeploymentservice", "veeamtransportsvc", "mvarmor", "mvarmor64", "vsnapvss", "acrsch2svc", "(.*?)sql(.*?)"] |
Data Leak Site
The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Qilin:
TOR DLS: ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion
Figure 10. Tor DLS
Detection Mechanisms
Arete Bloktd℠ Rules
Arete Bloktd℠ includes expert threat analysis, crafted threat hunting queries, and active deployment of preventive rules for adversarial behaviors on SentinelOne® protected assets monitored by Arete.
SentinelOne® S1QL 2.0 Query Syntax
Qilin Ransomwareendpoint.os = 'windows' and event.category = 'process' and event.type = 'Process Creation' and src.process.cmdline matches '\\.exe {1,4}--password {1,4}[a-zA-Z0-9-]{32} {1,4}--no-admin' Note: This threat hunting query may need to be tuned for your specific network environment. |
|---|
Yara
rule Qilin_ransomware_executable strings: condition: |
|---|
Recommended Mitigations
Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
Block any known attacker C2s in the firewall.
Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
Eliminate unnecessary RDP ports exposed to the internet.
Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
Perform periodic dark web monitoring to verify if data is available for sale on the black market.
Perform penetration tests.
Periodically patch systems and update tools.
Monitor connections to the network from suspicious locations.
Monitor downloads and uploads of files to file-sharing services outside standard work hours.
Monitor file uploads from domain controllers to the internet.
Monitor network scans from uncommon servers (e.g., RDP server).
Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.
Arete Advisors, LLC makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the contents of this report and expressly disclaims liability for errors and omissions in the content. Neither Arete Advisors, LLC, nor its employees and contractors make any warranty, express or implied or statutory, including but not limited to the warranties of non-infringement of third-party rights, title, and the warranties of merchantability and fitness for a particular purpose, with respect to content available from this report. Arete Advisors, LLC assumes no liability for any direct, indirect, or any other loss or damage of any kind for the accuracy, completely, or usefulness of any information, product, or process disclosed herein, and does not represent that the use of such information, product, or process would not infringe on privately owned rights. Information contained in this report is provided for educational purposes only and should not be considered as legal advice.
Article
Critical Vulnerability in Progress Kemp LoadMaster Exploited
Researchers have identified active exploitation of CVE-2026-8037, a critical unauthenticated remote code execution vulnerability affecting Progress Kemp LoadMaster. The vulnerability affects LoadMaster GA versions 7.2.63.1 and earlier and LTSF versions 7.2.54.17 and earlier and can allow a remote adversary to execute commands on an affected appliance without valid credentials when the vulnerable API is exposed. Progress has released updates addressing CVE-2026-8037 and CVE-2026-33691, a separate Web Application Firewall security control bypass, in GA 7.2.63.2 and LTSF 7.2.54.18.
The exploitation of this vulnerability reflects a broader trend of threat actors targeting internet-facing enterprise technologies. For example, Progress MOVEit Transfer experienced significant scanning and exploitation activity in 2025 involving CVE-2023-34362 and CVE-2023-36934, as well as the 2023 exploitation of CVE-2023-34362 by the Cl0p ransomware group for large-scale data theft and extortion. More recently, CISA confirmed the exploitation of SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, by ransomware groups. Collectively, these incidents demonstrate the continued targeting of perimeter-facing enterprise technologies as high-value entry points into corporate environments.
What’s Notable and Unique
Public exploit research, observed exploitation attempts, and CISA KEV inclusion indicate that CVE-2026-8037 has progressed into an active operational threat, increasing urgency for organizations with exposed and unpatched LoadMaster systems.
Internet-facing infrastructure can be rapidly identified through automated scanning, enabling threat actors to quickly identify vulnerable systems and capitalize on newly disclosed vulnerabilities and publicly available exploit techniques.
Analyst Comments
CVE-2026-8037 is significant not only for its severity but also because it affects infrastructure positioned between the internet and critical enterprise applications. The combination of external exposure, unauthenticated exploitation, and public exploit research lowers the barrier for threat actors seeking initial access, and the broader threat landscape reinforces this concern. The exploitation of Progress MOVEit by Cl0p, continued scanning activity against MOVEit, and recent ransomware exploitation of SonicWall SMA1000 vulnerabilities demonstrate sustained adversarial interest in perimeter-facing enterprise technologies. These incidents indicate that such infrastructure should be treated as high-value assets within enterprise security programs.
Sources
Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity
LoadMaster Critical Security Bulletin – June 2026 – (CVE-2026-8037, CVE-2026-33691)
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
Podcast
Blockchain Unmasked: The Role of Cryptocurrency in Cybercrime and Threat Intelligence
In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.
Article
ClickFix Evolves in Server-Side Polymorphic Malware Delivery Campaigns
The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls.
What’s Notable and Unique
ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain.
To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators.
The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses.
Analyst Comments
ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites.
Sources
The Evolution of ClickFix: From Cleartext to Server Side Polymorphism