Qilin ransomware surges to 101 incidents targeting industrial sectors
Q2 2025 saw 657 ransomware incidents against industrial entities globally, with Qilin emerging as dominant threat after RansomHub collapse and law enforcement disruptions.
Sourcedragos.com — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-21762, CVE-2024-50623, CVE-2024-55591, CVE-2024-55956, CVE-2024-57726, CVE-2024-57727, CVE-2024-57728, and CVE-2025-31324 as exploited in the wild.
Dragos documented 657 ransomware incidents impacting industrial organizations in Q2 2025, down from 708 in Q1. North America remained most targeted with 355 incidents (54%), while Europe saw significant increases to 173 incidents. Manufacturing continued as the primary victim sector at 65% of incidents, with construction subsector accounting for 110 attacks. The ransomware landscape underwent dramatic shifts following law enforcement actions including Operation Endgame 2.0 and affiliate arrests, causing RansomHub activity to collapse from dominant positioning to just 5 incidents. Qilin surged to become the most active group with 101 incidents, professionalizing operations with legal advisory services and media teams while systematically exploiting Fortinet vulnerabilities. Notably, North Korea's Moonstone Sleet adopted Qilin ransomware in March 2025, signaling geopolitical escalation beyond financial motives.
Emerging threats included Devman targeting high-revenue critical infrastructure, SafePay accelerating from 13 to 49 incidents using double-extortion tactics, and groups deploying ESXi-specific variants and ransomware with built-in wiper capabilities. Attackers increasingly exploited critical vulnerabilities in SAP NetWeaver (CVE-2025-31324), SimpleHelp RMM software, and FortiGate firewalls, while sophisticated social engineering techniques including IT helpdesk impersonation via phone and Teams calls led to ransomware deployment. High-impact incidents disrupted Nova Scotia Power's billing systems, halted Nucor steel production, reduced Masimo medical device manufacturing capacity, and caused extended order processing delays at food distributor UNFI.
The threat landscape shows continued fragmentation with emerging and rebranded groups employing double/triple-extortion combining encryption, data theft, and destructive wiping. Geopolitical tensions, particularly Israel-Iran conflict, introduced hacktivist personas using ransomware for disruption and Iranian groups offering higher affiliate payouts for attacks on US and Israeli targets. Organizations face escalating risks from AI-driven attack sophistication, targeted IT-OT environment exploitation, supply chain vulnerabilities, and increasingly selective attacks blending financial extortion with operational disruption aligned to geopolitical objectives.
Mentioned in this report
Detection guidance
Ransomware Pre-Encryption Service and Process Termination
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects mass termination of security, backup, and database services via net.exe, sc.exe, or taskkill, a common Qilin/ransomware precursor to encryption to prevent recovery and evade detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ransomware Pre-Encryption Service and Process Termination
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \net.exe
- \net1.exe
- \sc.exe
- \taskkill.exe
selection_action:
CommandLine|contains:
- ' stop '
- /stop
- -stop
- /f /im
- delete
selection_target:
CommandLine|contains:
- vss
- sql
- backup
- veeam
- sophos
- mcafee
- defender
- sentinel
- cortex
- msexchange
- memtas
- antivirus
filter_admin:
CommandLine|contains:
- spooler
- wuauserv
condition: selection_img and selection_action and selection_target and not filter_admin
falsepositives:
- Legitimate IT administration scripts that stop and restart backup agents or AV during
maintenance windows
- Software deployment tools performing scheduled service management
level: high
tags:
- attack.t1489
- attack.impact
id: 2302e883-05bb-5ed6-8727-d67a5db47058
status: experimental
author: Vorant
Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects use of vssadmin, wbadmin, or bcdedit to delete shadow copies, backup catalogs, or disable recovery options, a widely used anti-recovery step preceding ransomware encryption/wiping such as Qilin. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains:
- delete shadows
- resize shadowstorage
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains:
- delete catalog
- delete backup
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains:
- recoveryenabled no
- bootstatuspolicy ignoreallfailures
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains: shadowcopy delete
condition: 1 of selection_*
falsepositives:
- Backup software or system administrators legitimately clearing old shadow copies
to free disk space
- IT staff reconfiguring boot recovery settings during OS troubleshooting
level: high
tags:
- attack.t1485
- attack.impact
id: 35ba5661-f2ed-51e3-a01a-a84d6ac93ae1
status: experimental
author: Vorant
Multiple Failed RDP Logon Attempts Followed by Success (Possible Brute Force)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a pattern of repeated failed RDP/network logon attempts against a single account or host followed by a successful logon, consistent with brute-force or credential-stuffing activity used by Qilin affiliates to gain External Remote Services access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Failed RDP Logon Attempts Followed by Success
logsource:
product: windows
service: security
detection:
selection_failed:
EventID: 4625
LogonType: 10
selection_success:
EventID: 4624
LogonType: 10
condition: selection_failed and selection_success
fields:
- TargetUserName
- IpAddress
- LogonType
falsepositives:
- Users repeatedly mistyping credentials before a correct RDP login
- Automated monitoring or health-check accounts with misconfigured credentials
level: medium
tags:
- attack.t1110
- attack.t1078
- attack.t1021.001
- attack.credential-access
id: 26cc0243-caad-5dae-bc52-c402b2039cb1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2025
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs