Qilin ransomware claims Universitatea de Vest Arad compromise
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Qilin ransomware gang claims breach of Romanian university with 302 compromised users and exfiltrated data.
Ransomware.live, a platform indexing ransomware operator disclosures, reports that Qilin ransomware gang has claimed responsibility for a breach of Universitatea de Vest "Vasile Goldiș" in Arad, Romania. According to the posting, the attack resulted in 22 compromised employees, 302 compromised user accounts, and 89 third-party employee credentials exposed. The attacker also identified 51 items on the victim's external attack surface. The breach appears to have involved data exfiltration, as indicated by the leak screenshot referenced in the posting, though the underlying stolen data is not hosted or distributed via the ransomware.live indexing platform. This represents a typical ransomware affiliate operation combining credential compromise with organizational impact.
Defenders at educational institutions should treat this as confirmation that Qilin remains actively targeting the sector. The scale of user account compromise (302 accounts) suggests either broad lateral movement within the university network or successful exploitation of centralized authentication systems. The presence of third-party employee credentials (89 accounts) indicates either supply-chain access or use of vendor management systems during the intrusion.
Mentioned in this report
Detection guidance
Credential Manager Enumeration via VaultCmd or CmdKey
Detects vaultcmd/cmdkey being used to list stored Windows credentials, a common step before ransomware affiliates reuse harvested accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Credential Manager Enumeration via VaultCmd or CmdKey
description: Detects vaultcmd.exe or cmdkey.exe being used to list stored credentials.
This is a common credential-access step in ransomware intrusions that reuse harvested
accounts. The report gives no command lines, so this rule is based on the mapped
technique T1555, not on observed Qilin commands.
tags:
- attack.credential-access
- attack.t1555
logsource:
category: process_creation
product: windows
detection:
selection_vaultcmd:
Image|endswith: \vaultcmd.exe
CommandLine|contains:
- /list
- /listcreds
- /listproperties
selection_cmdkey:
Image|endswith: \cmdkey.exe
CommandLine|contains: /list
condition: 1 of selection_*
falsepositives:
- Administrators troubleshooting stored credentials on a workstation
- Helpdesk scripts that audit cached credentials
level: medium
id: d9610b74-bcd3-59c1-a96e-2c703f53db5a
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu
Privileged Domain Group Enumeration via Net Command
Detects net.exe/net1.exe querying high-privilege domain groups, typical account discovery before lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privileged Domain Group Enumeration via Net Command
description: Detects net.exe or net1.exe querying high-privilege domain groups such
as Domain Admins or Enterprise Admins. Ransomware affiliates use this account discovery
to find targets for lateral movement. The rule is based on the mapped technique
T1087, not on commands named in the report.
tags:
- attack.discovery
- attack.t1087.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \net.exe
- \net1.exe
selection_cmd:
CommandLine|contains|all:
- group
- /domain
selection_group:
CommandLine|contains:
- domain admins
- enterprise admins
- schema admins
- administrators
condition: selection_img and selection_cmd and selection_group
falsepositives:
- Domain administrators auditing privileged group membership
- Inventory or compliance scripts that enumerate admin groups
level: medium
id: b7c8eb27-5f81-5bd6-b4e8-f0542f42e066
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs