# Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen

> The University of Texas at Arlington (UTA) warned students and employees that hackers stole personal information in an October 2026 cyber incident, and the Qilin ransomware gang claimed the attack in the week of 2026-11-13. UTA took its MachForms portal offline and has not disclosed the data types or number of people affected.

- **Published:** 2026-11-13T18:55:05Z
- **Last reviewed:** 2026-11-13T18:55:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5985
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5985.png
- **ID:** TL-2026-5985
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

On 2026-11-13 The Record (Recorded Future News) reported that UT Arlington, one of the oldest and largest Texas universities with more than 41,000 undergraduate and graduate students, told students and employees that an investigation into a cybersecurity incident in the previous month (October 2026) confirmed that personal information was stolen. The university declined to say what information was taken and said it was still working to determine whose information may have been involved and the nature and extent of the information accessed; affected individuals will be contacted directly once identified. The number of affected people is not disclosed.

UTA took MachForms, an online portal used by students and employees for event registration, service requests and surveys, offline when the attack was first announced, and it remained offline at the time of reporting. The university said it continues to monitor for additional impacts to university systems or operations. The Qilin ransomware gang claimed the attack during the week of publication. This is a leak-site claim by the actor; no technical details of the intrusion (initial access vector, tooling, CVEs, malware samples or IOCs specific to UTA) have been published by the university or the press.

Context: per Halcyon Ransomware Research Center data cited by The Record, Qilin was linked to 344 alleged ransomware attacks from July to September 2026, the second-highest of any group. The same article notes a recent Qilin claim against the US ATF, that a leading Qilin affiliate was arrested in Japan and extradited to Germany, and other concurrent university incidents (York University, Vanderbilt University claimed by the BYOD gang, which also claimed Michigan State University and the University of New Mexico).

TTP and IOC caveat: Qilin (aka Agenda) is a ransomware-as-a-service operation active since mid-2022 with double extortion; affiliate tradecraft varies by incident. The ATT&CK mappings and indicators in this record are drawn from public vendor reporting on Qilin affiliates generally (ThreatLocker, CyberAngel, HHS/HC3 profile) and are NOT confirmed for the UTA intrusion. Defenders should treat them as a hunting baseline for Qilin activity, not as evidence of how UTA was compromised. BeaconBeagle correlation for the network IOCs could not be completed (service returned HTTP 502).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1003.001 LSASS Memory
- T1046 Network Service Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Qilin Credential Dumping and EDR Tamper - LSASS Access, Mimikatz and BYOVD TPwSav.sys** (`TL-2026-5985-SPL-002`)

Detects Sysmon EventCode 10 process access to lsass.exe with Mimikatz-typical access masks, Mimikatz module command lines (sekurlsa, lsadump, privilege::debug), Defender real-time protection being disabled, and the TPwSav.sys vulnerable driver being dropped or loaded (BYOVD EDR disablement). Reported in Qilin intrusions (CybelAngel); hunting baseline for TL-2026-5985.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1562.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h
  ((EventCode=10 TargetImage="*\\lsass.exe"
     (GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a" OR GrantedAccess="0x1fffff" OR GrantedAccess="0x1f3fff")
     NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\csrss.exe" OR SourceImage="*\\wininit.exe" OR SourceImage="*\\svchost.exe" OR SourceImage="*\\taskmgr.exe" OR SourceImage="*\\WerFault.exe"))
   OR (EventCode=1 (CommandLine="*sekurlsa::*" OR CommandLine="*lsadump::*" OR CommandLine="*privilege::debug*"
        OR (CommandLine="*Set-MpPreference*" CommandLine="*DisableRealtimeMonitoring*")
        OR CommandLine="*TPwSav*"))
   OR (EventCode=6 ImageLoaded="*\\TPwSav.sys")
   OR (EventCode=11 TargetFilename="*\\TPwSav.sys"))
| eval technique=case(EventCode=10, "T1003.001 Process opened lsass.exe with dumper-typical access mask",
    EventCode=1 AND match(CommandLine,"(?i)sekurlsa::|lsadump::|privilege::debug"), "T1003.001 Mimikatz module command line",
    true(), "T1562.001 BYOVD driver TPwSav.sys or Defender tampering to disable EDR")
| stats count min(_time) as first_seen values(SourceImage) as source_images values(GrantedAccess) as granted_access values(CommandLine) as commands values(ImageLoaded) as drivers values(TargetFilename) as dropped_files by host, technique
| convert ctime(first_seen)
| table host technique count first_seen source_images granted_access commands drivers dropped_files
```

### Microsoft KQL

```kql
// Qilin credential dumping (Mimikatz/LSASS) and EDR disablement (BYOVD TPwSav.sys, Defender tamper) - TL-2026-5985
let approved = dynamic(["MsMpEng.exe","csrss.exe","wininit.exe","svchost.exe","taskmgr.exe","WerFault.exe","MsSense.exe"]);
union
(DeviceEvents
 | where Timestamp > ago(24h)
 | where ActionType == "OpenProcessApiCall" and FileName =~ "lsass.exe"
 | where InitiatingProcessFileName !in~ (approved)
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1003.001 Process opened lsass.exe", Process = InitiatingProcessFileName, Detail = InitiatingProcessCommandLine),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine has_any ("sekurlsa::", "lsadump::", "privilege::debug")
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1003.001 Mimikatz module command line", Process = FileName, Detail = ProcessCommandLine),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where (ProcessCommandLine has "Set-MpPreference" and ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring")) or ProcessCommandLine has "TPwSav"
 | project Timestamp, Device = DeviceName, Account = AccountName, Technique = "T1562.001 Defender tamper or TPwSav driver service", Process = FileName, Detail = ProcessCommandLine),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "TPwSav.sys"
 | project Timestamp, Device = DeviceName, Account = InitiatingProcessAccountName, Technique = "T1562.001 BYOVD driver TPwSav.sys written to disk", Process = InitiatingProcessFileName, Detail = FolderPath)
```

### Sigma

```yaml
title: Qilin Credential Dumping and EDR Tamper - Mimikatz, Defender Disable, TPwSav BYOVD
id: 9d4e7a21-5b3c-4f88-a6d1-2c7e0b94f302
status: experimental
description: Detects Mimikatz module command lines, Defender real-time protection being disabled and references to the TPwSav.sys vulnerable driver, activity reported in Qilin intrusions (TL-2026-5985).
references:
  - https://therecord.media/university-of-texas-arlington-warns-data-breach
  - https://www.threatlocker.com/blog/qilin-raas-group-technical-analysis-from-initial-access-to-beaconing
  - https://cybelangel.com/blog/qilin-ransomware-tactics-attack/
  - https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.s0002
    - attack.tool.mimikatz
    - attack.defense_evasion
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_mimikatz:
        CommandLine|contains:
            - 'sekurlsa::'
            - 'lsadump::'
            - 'privilege::debug'
    selection_defender:
        CommandLine|contains|all:
            - 'Set-MpPreference'
            - 'DisableRealtimeMonitoring'
    selection_byovd:
        CommandLine|contains: 'TPwSav'
    condition: 1 of selection_*
falsepositives:
    - Red-team or penetration-test exercises running Mimikatz
    - Administrators temporarily disabling Defender during software installation
level: high

```

**Known false positives:**

- EDR/AV agents and backup software reading LSASS memory
- Administrators collecting LSASS crash dumps for support
- Authorized red-team activity using Mimikatz

**Tuning notes:** Extend the SourceImage exclusion list with your EDR and backup agent binaries; alert on any TPwSav.sys driver load regardless of exclusions; scope Set-MpPreference alerts to non-admin-workstation hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Qilin Initial Access - RVTools Lure, Exploited Web App Shell Spawn and Risky Valid-Account Sign-in (locked: unlock with TL Creds)
- Qilin Persistence, Masquerading Beacons and Ransom-Note Artifacts (locked: unlock with TL Creds)
- Qilin C2 - Beacon Domains/IPs, Periodic ~10 Minute Beaconing and Hijacked Remote-Access Tools (locked: unlock with TL Creds)
- Qilin Lateral Movement - Renamed PsExec, PSEXESVC and Admin-Share Tool Transfer (locked: unlock with TL Creds)
- Qilin Impact - Shadow Copy/Backup Destruction and Encryptor Execution (locked: unlock with TL Creds)
- Qilin C2 and Lure Domains - DNS Lookups for [indicator], [indicator] and [indicator] (locked: unlock with TL Creds)
- Qilin Precursors - RDP Enabled via reg.exe and Nmap 135/445 Scan (locked: unlock with TL Creds)
- Qilin Data Exfiltration - Rclone, Cyberduck and WinRAR Staging (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `68.65.122[.]246`
- Domain: `cloudflariz[.]com`
- File hash: `A51C8FCDE0BCC9FE8273F99C8B23E63CA4CD0F66B22CADD0BCB0F3ADB0FA05FA`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [University of Texas at Arlington warns personal information stolen during cyberattack](https://therecord.media/university-of-texas-arlington-warns-data-breach)
- [Qilin Ransomware: Technical Analysis from Initial Access to Beaconing (ThreatLocker)](https://www.threatlocker.com/blog/qilin-raas-group-technical-analysis-from-initial-access-to-beaconing)
- [Qilin Ransomware: Attack Methods and 2026 Status (CybelAngel)](https://cybelangel.com/blog/qilin-ransomware-tactics-attack/)
- [HHS/HC3 Qilin Threat Profile (TLP:CLEAR)](https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf)
- [Qilin ransomware suspect arrested in Japan, extradited to Germany (SecurityWeek)](https://www.securityweek.com/qilin-ransomware-suspect-arrested-in-japan-extradited-to-germany/)
- [Germany arrests alleged core Qilin ransomware member after extradition (BleepingComputer)](https://www.bleepingcomputer.com/news/security/germany-arrests-alleged-core-qilin-ransomware-member-after-extradition/)
- [Japan/Germany ransomware arrest (The Record)](https://therecord.media/japan-germany-ransomware-arrest)
- [Threat Bulletin: Qilin (aka Agenda) Ransomware - Evidence & TTPs (Kaseya)](https://labs.kaseya.com/?p=276)
- [Qilin Top Ransomware Threat to SLTTs in Q2 2025 (CIS)](https://www.cisecurity.org/blog/qilin-top-ransomware-threat-to-sltts-in-q2-2025)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5985