Loading story…
Cornerstone Staffing Solutions disclosed that attackers accessed its network between November 6 and 21, 2025, with suspicious activity detected around November 17. A subsequent forensic investigation found evidence that data may have been removed, although the company could not determine precisely which files were affected. Dark-web monitoring identified Qilin as an apparent claimant after the ransomware group posted alleged Cornerstone data on its Tor leak site on November 13. The Dallas/Fort Worth staffing firm began notifying affected individuals on September 11, 2026; the potentially exposed information includes personal, financial, and health data, with notifications reported for at least 4,425 Texas and 243 Massachusetts residents.
Qilin—also tracked as Agenda, GOLD FEATHER, Phantom Mantis, and Water Galura—is a Russian-speaking ransomware-as-a-service operation using an affiliate model and dual extortion. Its affiliates commonly obtain initial access through stolen VPN, RDP, or Citrix credentials, exposed FortiGate, SAP NetWeaver, and Veeam vulnerabilities, or compromised ScreenConnect administrator accounts. Defenders should prioritize monitoring for Qilin-associated activity including ngrok reverse tunnels, SoftPerfect Network Scanner (netscan.exe) discovery, esentutl.exe copies of browser credential databases, and WinRAR staging with the -ep1 -scul -r0 option combination; these behaviors can support credential theft, reconnaissance, data exfiltration, and ransomware deployment.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
Cornerstone Staffing began mailing breach notifications to affected individuals, including at least 4,425 Texas residents and 243 Massachusetts residents. The potentially exposed data included personal, financial, government-identification, and health information.
ShroudCloud published a high-severity detection for WinRAR or RAR executions using the -ep1, -scul, and -r0 flags, a pre-exfiltration staging pattern observed in Qilin activity.
ShroudCloud published a stable Sigma rule for detecting esentutl.exe copying locked browser credential databases for offline extraction. The technique was reported in Qilin intrusions.
ShroudCloud published a stable Sigma rule to detect SoftPerfect Network Scanner, including netscan.exe, in Windows process-creation telemetry. The rule identified Qilin ransomware operations among reported abusers of the tool.
ShroudCloud published the stable “Reverse Tunnel Tool Execution” Sigma rule for Windows process creation, covering Cloudflared, ngrok, Ligolo, and Chisel. The rule noted reported Qilin abuse of ngrok.
Cornerstone Staffing became aware of suspicious network activity and launched a forensic investigation, which found indications that data may have been removed.
Qilin posted on its Tor presence claiming it had obtained data from Cornerstone Staffing Solutions.
An unauthorized actor may have accessed Cornerstone Staffing Solutions' systems during an intrusion that continued through November 21, 2025.
Qilin reportedly recruited or absorbed affiliates after RansomHub ceased operations.
Microsoft Threat Intelligence reportedly attributed Moonstone Sleet activity to Qilin affiliate operations.
The Qilin operation reportedly recorded more than 1,000 victims during 2025.
A campaign tracked as STAC4365 used Evilginx adversary-in-the-middle phishing to intercept MSP administrator credentials and MFA TOTP codes, obtaining ScreenConnect super-administrator access.
An operator using the alias Haise advertised the Qilin ransomware operation on the RAMP forum.
The operation reportedly rebranded from Agenda to Qilin and introduced a Rust-based ransomware rewrite.
The ransomware operation originally known as Agenda was first observed using a Golang payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourcesans.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Qilin ransomware gang has claimed responsibility for significant cyberattacks against major North American organizations, including Canadian electrical services provider Spark Power and U.S.-based recruitment firm Cornerstone Staffing Solutions. In the Spark Power incident, Qilin alleges the theft of 222 GB of data, potentially including operational files, financial records, and employee personal information, with researchers warning of possible operational disruptions if systems are locked. For Cornerstone Staffing Solutions, Qilin claims to have exfiltrated 300 GB of sensitive data, including nearly 1 million files with resumes, personal records, Social Security numbers, and internal financial documents, with sample files leaked to substantiate the breach. Qilin has emerged as one of the most prolific ransomware operations, reportedly targeting nearly 1,000 organizations since 2023 and over 500 in the past six months alone. The group’s attacks have resulted in the exposure of sensitive employee and business data, raising concerns about the operational and reputational impact on affected organizations. These incidents highlight the ongoing threat posed by ransomware groups to critical infrastructure and service providers across North America.
Jun 29, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
The Qilin ransomware group, also known as Agenda, has adopted a sophisticated cross-platform attack strategy by deploying Linux-based ransomware binaries on Windows systems. This technique leverages legitimate remote management and file transfer tools such as Splashtop, WinSCP, AnyDesk, ATERA RMM, ScreenConnect, and MeshCentral to bypass traditional Windows-centric endpoint detection and response (EDR) solutions. Attackers gain initial access through social engineering, including fake CAPTCHA pages, and use credential theft to facilitate lateral movement and privilege escalation. The group also employs Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security defenses and steals backup credentials, particularly from Veeam, to prevent recovery and maximize extortion leverage. Qilin's operations have impacted over 700 victims globally since January 2025, with a focus on sectors such as manufacturing, professional and scientific services, and wholesale trade. The group uses a double-extortion model, exfiltrating sensitive data with tools like Cyberduck before encrypting files and threatening public disclosure. Qilin's affiliates have been observed using a variety of post-exploitation tools, including Mimikatz and custom scripts, to harvest credentials and exfiltrate data. The group's rapid evolution and ability to evade detection highlight the growing sophistication of ransomware-as-a-service (RaaS) operations targeting organizations worldwide.
Jun 29, 2026