Loading story…
Sophos X-Ops reported that a Qilin ransomware intrusion used a malicious Active Directory Group Policy Object (GPO) to harvest credentials stored in Google Chrome before encrypting systems. The attack began with compromised credentials used against a VPN portal that lacked multifactor authentication, after which the attackers spent 18 days in the environment moving laterally, reaching a domain controller, and modifying the default domain policy. They deployed a PowerShell script named IPScanner.ps1 and a batch file, logon.bat, through logon policy to collect browser credential data from multiple endpoints.
The stolen data was written to the SYSVOL share in files organized by hostname, allowing the attackers to gather credentials across the domain for more than three days before exfiltrating the results, deleting the files, and clearing event logs. The same GPO mechanism was later used to create a scheduled task that downloaded and executed Qilin ransomware. Sophos warned that the operation increased downstream risk because browser-stored passwords could expose third-party accounts beyond the victim organization, and recommended MFA and dedicated password managers instead of storing credentials in browsers.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos X-Ops reported the July 2024 incident and detailed how Qilin operators used malicious Group Policy to harvest Chrome-stored credentials before ransomware deployment. The report also warned that the tactic could expose third-party accounts beyond the directly affected organization.
After leaving the credential-harvesting GPO active for more than three days, the attackers exfiltrated the collected data, deleted the files, and cleared event logs. They then used Group Policy again to create a scheduled task that downloaded and executed Qilin ransomware.
During the July 2024 incident, the attackers modified the default domain policy on a domain controller to deploy a malicious logon GPO. The GPO used IPScanner.ps1 and logon.bat to collect Google Chrome credential data from multiple endpoints and write it to the SYSVOL share by hostname.
In July 2024, attackers obtained access to the victim environment using compromised credentials through a VPN portal that did not have multifactor authentication enabled. Sophos said the intrusion then persisted in the environment for 18 days before later stages of the attack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Qilin ransomware group, also known as Agenda, has adopted a sophisticated cross-platform attack strategy by deploying Linux-based ransomware binaries on Windows systems. This technique leverages legitimate remote management and file transfer tools such as Splashtop, WinSCP, AnyDesk, ATERA RMM, ScreenConnect, and MeshCentral to bypass traditional Windows-centric endpoint detection and response (EDR) solutions. Attackers gain initial access through social engineering, including fake CAPTCHA pages, and use credential theft to facilitate lateral movement and privilege escalation. The group also employs Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security defenses and steals backup credentials, particularly from Veeam, to prevent recovery and maximize extortion leverage. Qilin's operations have impacted over 700 victims globally since January 2025, with a focus on sectors such as manufacturing, professional and scientific services, and wholesale trade. The group uses a double-extortion model, exfiltrating sensitive data with tools like Cyberduck before encrypting files and threatening public disclosure. Qilin's affiliates have been observed using a variety of post-exploitation tools, including Mimikatz and custom scripts, to harvest credentials and exfiltrate data. The group's rapid evolution and ability to evade detection highlight the growing sophistication of ransomware-as-a-service (RaaS) operations targeting organizations worldwide.
Jun 29, 2026
Researchers reported that the **Agenda** ransomware operation, also tracked as **Qilin**, is conducting highly customized enterprise attacks across Asia and Africa and has now been linked to a victim in South Africa. A recent victim listing identified **Trends And Concepts** in South Africa, associated with the domain `www.trendsandconceptsinteriors.com`, as impacted by the Qilin group. Trend researchers said Agenda operators build victim-specific Go-based payloads that can include leaked account credentials, unique company identifiers, customized RSA keys, and ransom demands ranging from **$50,000 to $800,000**, with observed targeting of healthcare and education organizations in Indonesia, Saudi Arabia, South Africa, and Thailand. The intrusion methods described across the reports show a flexible and increasingly sophisticated playbook. In one case, attackers accessed a public-facing **Citrix** server using a valid account, moved laterally with **RDP** and leaked **Active Directory** credentials, scanned networks with **Nmap** and **Nping**, and deployed ransomware through **Group Policy** in under two days. A separate Trend investigation found Agenda actors using fake Google CAPTCHA pages to deliver credential stealers, then abusing legitimate remote-management tools including **ATERA**, **AnyDesk**, **ScreenConnect**, and **Splashtop**, while deploying **COROXY** SOCKS proxies, targeting **Veeam** backup infrastructure, and using **BYOVD** techniques with vulnerable drivers such as `eskle.sys`; the final ransomware payload was reportedly a Linux variant executed on Windows, likely through **Windows Subsystem for Linux**.
Aug 21, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026