Skip to navigation

Threat reportRansomwareTL-2026-5985

Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen

highACTIVE

The University of Texas at Arlington (UTA) warned students and employees that hackers stole personal information in an October 2026 cyber incident, and the Qilin ransomware gang claimed the attack in the week of 2026-11-13. UTA took its MachForms portal offline and has not disclosed the data types or number of people affected.

Key facts

IdentifiersTL-2026-5985
Also known asUT Arlington cyberattack, UTA MachForms incident
SeverityHIGH
First disclosed
Affected productsUniversity of Texas at Arlington University IT systems and MachForms event-registration/service-request/survey portal
AttributionQilin (medium confidence)
MalwareAgendaCrypt, MimiKatz
ToolsMimikatz, PSEXEC, Rclone - S1040, ScreenConnect
MITRE ATT&CK techniquesT1003.001 LSASS Memory, T1021.001 Remote Desktop Protocol, T1021.002 SMB/Windows Admin Shares, T1046 Network Service Discovery, T1059.003 Windows Command Shell, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1219 Remote Access Tools, T1490 Inhibit System Recovery, T1547.001 Registry Run Keys / Startup Folder, T1566 Phishing, T1567.002 Exfiltration to Cloud Storage and 3 more in the attack flow
MotivationFINANCIAL
Target sectorseducation, government administration, health, manufacturing
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5985 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Qilin Credential Dumping and EDR Tamper - LSASS Access, Mimikatz and BYOVD TPwSav.sys

Detects Sysmon EventCode 10 process access to lsass.exe with Mimikatz-typical access masks, Mimikatz module command lines (sekurlsa, lsadump, privilege::debug), Defender real-time protection being disabled, and the TPwSav.sys vulnerable driver being dropped or loaded (BYOVD EDR disablement). Reported in Qilin intrusions (CybelAngel); hunting baseline for TL-2026-5985.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1003.001, T1562.001
  • Data sources: sysmon, microsoft_defender_for_endpoint, windows_process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h
  ((EventCode=10 TargetImage="*\\lsass.exe"
     (GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a" OR GrantedAccess="0x1fffff" OR GrantedAccess="0x1f3fff")
     NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\csrss.exe" OR SourceImage="*\\wininit.exe" OR SourceImage="*\\svchost.exe" OR SourceImage="*\\taskmgr.exe" OR SourceImage="*\\WerFault.exe"))
   OR (EventCode=1 (CommandLine="*sekurlsa::*" OR CommandLine="*lsadump::*" OR CommandLine="*privilege::debug*"
        OR (CommandLine="*Set-MpPreference*" CommandLine="*DisableRealtimeMonitoring*")
        OR CommandLine="*TPwSav*"))
   OR (EventCode=6 ImageLoaded="*\\TPwSav.sys")
   OR (EventCode=11 TargetFilename="*\\TPwSav.sys"))
| eval technique=case(EventCode=10, "T1003.001 Process opened lsass.exe with dumper-typical access mask",
    EventCode=1 AND match(CommandLine,"(?i)sekurlsa::|lsadump::|privilege::debug"), "T1003.001 Mimikatz module command line",
    true(), "T1562.001 BYOVD driver TPwSav.sys or Defender tampering to disable EDR")
| stats count min(_time) as first_seen values(SourceImage) as source_images values(GrantedAccess) as granted_access values(CommandLine) as commands values(ImageLoaded) as drivers values(TargetFilename) as dropped_files by host, technique
| convert ctime(first_seen)
| table host technique count first_seen source_images granted_access commands drivers dropped_files

Microsoft KQL

// Qilin credential dumping (Mimikatz/LSASS) and EDR disablement (BYOVD TPwSav.sys, Defender tamper) - TL-2026-5985
let approved = dynamic(["MsMpEng.exe","csrss.exe","wininit.exe","svchost.exe","taskmgr.exe","WerFault.exe","MsSense.exe"]);
union
(DeviceEvents
 | where Timestamp > ago(24h)
 | where ActionType == "OpenProcessApiCall" and FileName =~ "lsass.exe"
 | where InitiatingProcessFileName !in~ (approved)
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1003.001 Process opened lsass.exe", Process = InitiatingProcessFileName, Detail = InitiatingProcessCommandLine),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine has_any ("sekurlsa::", "lsadump::", "privilege::debug")
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1003.001 Mimikatz module command line", Process = FileName, Detail = ProcessCommandLine),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where (ProcessCommandLine has "Set-MpPreference" and ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring")) or ProcessCommandLine has "TPwSav"
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1562.001 Defender tamper or TPwSav driver service", Process = FileName, Detail = ProcessCommandLine),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "TPwSav.sys"
 | project Timestamp, Device = DeviceName, Account = InitiatingProcessAccountName, Technique = "T1562.001 BYOVD driver TPwSav.sys written to disk", Process = InitiatingProcessFileName, Detail = FolderPath)

Sigma

title: Qilin Credential Dumping and EDR Tamper - Mimikatz, Defender Disable, TPwSav BYOVD
id: 9d4e7a21-5b3c-4f88-a6d1-2c7e0b94f302
status: experimental
description: Detects Mimikatz module command lines, Defender real-time protection being disabled and references to the TPwSav.sys vulnerable driver, activity reported in Qilin intrusions (TL-2026-5985).
references:
  - https://therecord.media/university-of-texas-arlington-warns-data-breach
  - https://www.threatlocker.com/blog/qilin-raas-group-technical-analysis-from-initial-access-to-beaconing
  - https://cybelangel.com/blog/qilin-ransomware-tactics-attack/
  - https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.s0002
    - attack.tool.mimikatz
    - attack.defense_evasion
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_mimikatz:
        CommandLine|contains:
            - 'sekurlsa::'
            - 'lsadump::'
            - 'privilege::debug'
    selection_defender:
        CommandLine|contains|all:
            - 'Set-MpPreference'
            - 'DisableRealtimeMonitoring'
    selection_byovd:
        CommandLine|contains: 'TPwSav'
    condition: 1 of selection_*
falsepositives:
    - Red-team or penetration-test exercises running Mimikatz
    - Administrators temporarily disabling Defender during software installation
level: high

Known false positives:

  • EDR/AV agents and backup software reading LSASS memory
  • Administrators collecting LSASS crash dumps for support
  • Authorized red-team activity using Mimikatz

Tuning notes: Extend the SourceImage exclusion list with your EDR and backup agent binaries; alert on any TPwSav.sys driver load regardless of exclusions; scope Set-MpPreference alerts to non-admin-workstation hosts.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Qilin Initial Access - RVTools Lure, Exploited Web App Shell Spawn and Risky Valid-Account Sign-in · unlock with TL Creds
  • Qilin Persistence, Masquerading Beacons and Ransom-Note Artifacts · unlock with TL Creds
  • Qilin C2 - Beacon Domains/IPs, Periodic ~10 Minute Beaconing and Hijacked Remote-Access Tools · unlock with TL Creds
  • Qilin Lateral Movement - Renamed PsExec, PSEXESVC and Admin-Share Tool Transfer · unlock with TL Creds
  • Qilin Impact - Shadow Copy/Backup Destruction and Encryptor Execution · unlock with TL Creds
  • Qilin C2 and Lure Domains - DNS Lookups for [indicator], [indicator] and [indicator] · unlock with TL Creds
  • Qilin Precursors - RDP Enabled via reg.exe and Nmap 135/445 Scan · unlock with TL Creds
  • Qilin Data Exfiltration - Rclone, Cyberduck and WinRAR Staging · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5985.

Sample indicators (3 of 20)

  • IP address: 68.65.122[.]246
  • Domain: cloudflariz[.]com
  • File hash: A51C8FCDE0BCC9FE8273F99C8B23E63CA4CD0F66B22CADD0BCB0F3ADB0FA05FA

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

20 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On 2026-11-13 The Record (Recorded Future News) reported that UT Arlington, one of the oldest and largest Texas universities with more than 41,000 undergraduate and graduate students, told students and employees that an investigation into a cybersecurity incident in the previous month (October 2026) confirmed that personal information was stolen. The university declined to say what information was taken and said it was still working to determine whose information may have been involved and the nature and extent of the information accessed; affected individuals will be contacted directly once identified. The number of affected people is not disclosed.

UTA took MachForms, an online portal used by students and employees for event registration, service requests and surveys, offline when the attack was first announced, and it remained offline at the time of reporting. The university said it continues to monitor for additional impacts to university systems or operations. The Qilin ransomware gang claimed the attack during the week of publication. This is a leak-site claim by the actor; no technical details of the intrusion (initial access vector, tooling, CVEs, malware samples or IOCs specific to UTA) have been published by the university or the press.

Context: per Halcyon Ransomware Research Center data cited by The Record, Qilin was linked to 344 alleged ransomware attacks from July to September 2026, the second-highest of any group. The same article notes a recent Qilin claim against the US ATF, that a leading Qilin affiliate was arrested in Japan and extradited to Germany, and other concurrent university incidents (York University, Vanderbilt University claimed by the BYOD gang, which also claimed Michigan State University and the University of New Mexico).

TTP and IOC caveat: Qilin (aka Agenda) is a ransomware-as-a-service operation active since mid-2022 with double extortion; affiliate tradecraft varies by incident. The ATT&CK mappings and indicators in this record are drawn from public vendor reporting on Qilin affiliates generally (ThreatLocker, CyberAngel, HHS/HC3 profile) and are NOT confirmed for the UTA intrusion. Defenders should treat them as a hunting baseline for Qilin activity, not as evidence of how UTA was compromised. BeaconBeagle correlation for the network IOCs could not be completed (service returned HTTP 502).

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer

Discovery

T1046 Network Service Discovery

Execution

T1059.003 Windows Command Shell; T1569.002 Service Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery

Persistence

T1547.001 Registry Run Keys / Startup Folder

Exfiltration

T1567.002 Exfiltration to Cloud Storage

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

  • Patch internet-facing appliances Qilin affiliates have been reported exploiting: Fortinet CVE-2024-21762 and CVE-2024-55591, JetBrains TeamCity CVE-2024-27198, Veeam CVE-2023-27532 (per CyberAngel; not tied to UTA)

Immediate actions

  • Hunt for Qilin affiliate precursors: renamed PsExec, Nmap scans for ports 135/445, reg.exe enabling RDP (fDenyTSConnections=0), startup-folder shortcuts and Run keys
  • Review and restrict exposure of public web forms/portals (e.g. MachForms-style form builders) and rotate credentials stored in or reachable from them
  • Block and alert on known Qilin-family C2 domains and hashes listed in the IOCs (reported for other Qilin intrusions)
  • Alert on bulk outbound transfers via Rclone, Cyberduck or WinRAR-staged archives to cloud storage

Workarounds

  • Keep the affected MachForms portal offline until the investigation and credential rotation are complete
  • Restrict or block unsanctioned remote-access tools (AnyDesk, ScreenConnect, Splashtop, TeamViewer)

Longer-term hardening

  • Enforce phishing-resistant MFA on VPN, RDP, WinRM and remote-management tools
  • Remove internet exposure of RDP/WinRM; disable NTLMv1 and anonymous SMB logons
  • Maintain immutable, offline backups including backup-catalog protection (Veeam) and test restores
  • Deploy EDR with tamper protection and vulnerable-driver (BYOVD) blocklists
  • Segment student, employee and research data stores and monitor for mass access/exfiltration

Affected and fixed versions

  • University of Texas at Arlington — University IT systems and MachForms event-registration/service-request/survey portal

Timeline

  • Qilin RaaS first appears as 'Agenda' (HHS/HC3 profile says July 2022; CybelAngel cites Aug-Sep 2022 launch/rebrand; month-level precision).
  • Qilin publishes about 400GB stolen from Synnovis (NHS pathology) after a roughly $50M ransom demand, illustrating its double-extortion model (CybelAngel).
  • End of July-September 2026 period in which Halcyon links Qilin to 344 alleged ransomware attacks, the second-highest of any group.
  • Cybersecurity incident at UT Arlington occurs in October 2026 (exact day not disclosed; month-level precision). MachForms portal is taken offline when the attack is first announced.
  • A suspected Qilin member detained in Japan is reported (single source) transferred to Germany on October 2; Germany alleges involvement in a 2024 attack on a logistics company.
  • Vanderbilt University, attacked the previous week by the BYOD gang, says full restoration will likely take multiple weeks, showing a concurrent wave of higher-education ransomware incidents.
  • UT Arlington warns students and employees that personal information was stolen; Qilin claims the attack the same week and The Record reports it. Data types and number affected remain undisclosed.

Sources cited

More from Qilin

Previous and next in ransomware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats