Threat video1:00
Qilin Leads Q3 2026 Non-Mobile Threats: Detection & IOCs
Qilin leads Kaspersky's Q3 2026 leak-site victims at 15.39%; 9 detection rules, 42 IOCs and 24 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for Qilin Leads Q3 2026 Non-Mobile Threats: Detection & IOCs →
Chapters
- 0:00The hook4,470 new ransomware variants.
- 0:04The storyEdge devices were a key entry.
- 0:11Attack pathArctic Wolf saw Qilin abuse a login bypass.
- 0:25AttributionAttributed to Qilin.
- 0:30Indicators of compromise39 indicators to hunt: 8 IPs, 1 IP range and 8 domains, and more.
- 0:38MITRE ATT&CK techniques24 ATT&CK techniques, from initial access to impact.
- 0:43Remediation5 steps now: Patch PAN-OS GlobalProtect against.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:004,470 new ransomware variants.
0:05Edge devices were a key entry.
0:07SonicWall patched in July.
0:11Arctic Wolf saw Qilin abuse a login bypass.
0:14They dumped credentials from memory.
0:17Rclone moved data to MEGA.
0:19Veeam backups were targeted.
0:21Then Qilin ransomware ran.
0:26Attributed to Qilin. Confidence: medium.
0:3139 indicators to hunt: 8 IPs, 1 IP range and 8 domains, and more.
0:3824 ATT&CK techniques, from initial access to impact.
0:435 steps now: Patch PAN-OS GlobalProtect against.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.