Picus Qilin MAR 2025

Qilin can employ an embedded Mimikatz module to dump LSASS memory.

Qilin can enumerate domain-connected hosts during its discovery phase.

Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.

Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script. Qilin has also used PowerShell for discovery in vCenter and Active Directory environments.

Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client. Qilin can also modify `HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper` to enable posting of ransom messages.

Qilin can use an embedded Mimikatz module for token manipulation.

Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.

Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.

Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

Qilin can initiate a reboot of the backup server to hinder recovery.

Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.

Qilin can terminate antivirus-related processes and services.