# Qilin ransomware claims Universitatea de Vest Arad compromise

Published: 2026-07-26 · Severity: high · Sectors: education
Canonical: https://vorant.io/reports/951e5cba-9355-55aa-a4c3-97ebfbea220a/qilin-ransomware-claims-universitatea-de-vest-arad-compromise

> Qilin ransomware gang claims breach of Romanian university with 302 compromised users and exfiltrated data.

Ransomware.live, a platform indexing ransomware operator disclosures, reports that Qilin ransomware gang has claimed responsibility for a breach of Universitatea de Vest "Vasile Goldiș" in Arad, Romania. According to the posting, the attack resulted in 22 compromised employees, 302 compromised user accounts, and 89 third-party employee credentials exposed. The attacker also identified 51 items on the victim's external attack surface. The breach appears to have involved data exfiltration, as indicated by the leak screenshot referenced in the posting, though the underlying stolen data is not hosted or distributed via the ransomware.live indexing platform. This represents a typical ransomware affiliate operation combining credential compromise with organizational impact.

Defenders at educational institutions should treat this as confirmation that Qilin remains actively targeting the sector. The scale of user account compromise (302 accounts) suggests either broad lateral movement within the university network or successful exploitation of centralized authentication systems. The presence of third-party employee credentials (89 accounts) indicates either supply-chain access or use of vendor management systems during the intrusion.

## Mentioned in this report

- Threat actors: qilin
- Malware: Qilin

## Detection guidance (public sample)

### Credential Manager Enumeration via VaultCmd or CmdKey

ATT&CK: T1555

Detects vaultcmd/cmdkey being used to list stored Windows credentials, a common step before ransomware affiliates reuse harvested accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Credential Manager Enumeration via VaultCmd or CmdKey
description: Detects vaultcmd.exe or cmdkey.exe being used to list stored credentials.
  This is a common credential-access step in ransomware intrusions that reuse harvested
  accounts. The report gives no command lines, so this rule is based on the mapped
  technique T1555, not on observed Qilin commands.
tags:
- attack.credential-access
- attack.t1555
logsource:
  category: process_creation
  product: windows
detection:
  selection_vaultcmd:
    Image|endswith: \vaultcmd.exe
    CommandLine|contains:
    - /list
    - /listcreds
    - /listproperties
  selection_cmdkey:
    Image|endswith: \cmdkey.exe
    CommandLine|contains: /list
  condition: 1 of selection_*
falsepositives:
- Administrators troubleshooting stored credentials on a workstation
- Helpdesk scripts that audit cached credentials
level: medium
id: d9610b74-bcd3-59c1-a96e-2c703f53db5a
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu
```

### Privileged Domain Group Enumeration via Net Command

ATT&CK: T1087

Detects net.exe/net1.exe querying high-privilege domain groups, typical account discovery before lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Privileged Domain Group Enumeration via Net Command
description: Detects net.exe or net1.exe querying high-privilege domain groups such
  as Domain Admins or Enterprise Admins. Ransomware affiliates use this account discovery
  to find targets for lateral movement. The rule is based on the mapped technique
  T1087, not on commands named in the report.
tags:
- attack.discovery
- attack.t1087.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_cmd:
    CommandLine|contains|all:
    - group
    - /domain
  selection_group:
    CommandLine|contains:
    - domain admins
    - enterprise admins
    - schema admins
    - administrators
  condition: selection_img and selection_cmd and selection_group
falsepositives:
- Domain administrators auditing privileged group membership
- Inventory or compliance scripts that enumerate admin groups
level: medium
id: b7c8eb27-5f81-5bd6-b4e8-f0542f42e066
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/VW5pdmVyc2l0YXRlYSBkZSBWZXN0IOKAnlZhc2lsZSBHb2xkaciZ4oCdIGRpbiBBcmFkQHFpbGlu

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/951e5cba-9355-55aa-a4c3-97ebfbea220a/qilin-ransomware-claims-universitatea-de-vest-arad-compromise.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup