# Qilin ransomware surges to 101 incidents targeting industrial sectors

Published: 2026-06-04 · Severity: medium · Sectors: manufacturing, energy, healthcare, transportation, technology, telecommunications, infrastructure, government-national, defense, retail, financial-services
Canonical: https://vorant.io/reports/f8be3aac-9b8c-4f39-af82-893fae5fb909/qilin-ransomware-surges-to-101-incidents-targeting-industrial-sectors

> Q2 2025 saw 657 ransomware incidents against industrial entities globally, with Qilin emerging as dominant threat after RansomHub collapse and law enforcement disruptions.

Dragos documented 657 ransomware incidents impacting industrial organizations in Q2 2025, down from 708 in Q1. North America remained most targeted with 355 incidents (54%), while Europe saw significant increases to 173 incidents. Manufacturing continued as the primary victim sector at 65% of incidents, with construction subsector accounting for 110 attacks. The ransomware landscape underwent dramatic shifts following law enforcement actions including Operation Endgame 2.0 and affiliate arrests, causing RansomHub activity to collapse from dominant positioning to just 5 incidents. Qilin surged to become the most active group with 101 incidents, professionalizing operations with legal advisory services and media teams while systematically exploiting Fortinet vulnerabilities. Notably, North Korea's Moonstone Sleet adopted Qilin ransomware in March 2025, signaling geopolitical escalation beyond financial motives.

Emerging threats included Devman targeting high-revenue critical infrastructure, SafePay accelerating from 13 to 49 incidents using double-extortion tactics, and groups deploying ESXi-specific variants and ransomware with built-in wiper capabilities. Attackers increasingly exploited critical vulnerabilities in SAP NetWeaver (CVE-2025-31324), SimpleHelp RMM software, and FortiGate firewalls, while sophisticated social engineering techniques including IT helpdesk impersonation via phone and Teams calls led to ransomware deployment. High-impact incidents disrupted Nova Scotia Power's billing systems, halted Nucor steel production, reduced Masimo medical device manufacturing capacity, and caused extended order processing delays at food distributor UNFI.

The threat landscape shows continued fragmentation with emerging and rebranded groups employing double/triple-extortion combining encryption, data theft, and destructive wiping. Geopolitical tensions, particularly Israel-Iran conflict, introduced hacktivist personas using ransomware for disruption and Iranian groups offering higher affiliate payouts for attacks on US and Israeli targets. Organizations face escalating risks from AI-driven attack sophistication, targeted IT-OT environment exploitation, supply chain vulnerabilities, and increasingly selective attacks blending financial extortion with operational disruption aligned to geopolitical objectives.

## Mentioned in this report

- Vulnerabilities: CVE-2024-21762 (KEV), CVE-2024-50623 (KEV), CVE-2024-55591 (KEV), CVE-2024-55956 (KEV), CVE-2024-57726 (KEV), CVE-2024-57727 (KEV), CVE-2024-57728 (KEV), CVE-2025-31324 (KEV)
- Threat actors: Moonstone Sleet, Storm-1811
- Malware: Anubis, BianLian, CL0P, DEVMAN, DoppelPaymer, DragonForce, LockBit3.0, PLAY, Qilin, RansomEXX, RansomHub, SafePay, SuperBlack

## Detection guidance (public sample)

### Ransomware Pre-Encryption Service and Process Termination

ATT&CK: T1489

Detects mass termination of security, backup, and database services via net.exe, sc.exe, or taskkill, a common Qilin/ransomware precursor to encryption to prevent recovery and evade detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ransomware Pre-Encryption Service and Process Termination
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
    - \sc.exe
    - \taskkill.exe
  selection_action:
    CommandLine|contains:
    - ' stop '
    - /stop
    - -stop
    - /f /im
    - delete
  selection_target:
    CommandLine|contains:
    - vss
    - sql
    - backup
    - veeam
    - sophos
    - mcafee
    - defender
    - sentinel
    - cortex
    - msexchange
    - memtas
    - antivirus
  filter_admin:
    CommandLine|contains:
    - spooler
    - wuauserv
  condition: selection_img and selection_action and selection_target and not filter_admin
falsepositives:
- Legitimate IT administration scripts that stop and restart backup agents or AV during
  maintenance windows
- Software deployment tools performing scheduled service management
level: high
tags:
- attack.t1489
- attack.impact
id: 2302e883-05bb-5ed6-8727-d67a5db47058
status: experimental
author: Vorant
```

### Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction

ATT&CK: T1485

Detects use of vssadmin, wbadmin, or bcdedit to delete shadow copies, backup catalogs, or disable recovery options, a widely used anti-recovery step preceding ransomware encryption/wiping such as Qilin. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains:
    - delete shadows
    - resize shadowstorage
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains: shadowcopy delete
  condition: 1 of selection_*
falsepositives:
- Backup software or system administrators legitimately clearing old shadow copies
  to free disk space
- IT staff reconfiguring boot recovery settings during OS troubleshooting
level: high
tags:
- attack.t1485
- attack.impact
id: 35ba5661-f2ed-51e3-a01a-a84d6ac93ae1
status: experimental
author: Vorant
```

### Multiple Failed RDP Logon Attempts Followed by Success (Possible Brute Force)

ATT&CK: T1110

Detects a pattern of repeated failed RDP/network logon attempts against a single account or host followed by a successful logon, consistent with brute-force or credential-stuffing activity used by Qilin affiliates to gain External Remote Services access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Multiple Failed RDP Logon Attempts Followed by Success
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed and selection_success
fields:
- TargetUserName
- IpAddress
- LogonType
falsepositives:
- Users repeatedly mistyping credentials before a correct RDP login
- Automated monitoring or health-check accounts with misconfigured credentials
level: medium
tags:
- attack.t1110
- attack.t1078
- attack.t1021.001
- attack.credential_access
id: 26cc0243-caad-5dae-bc52-c402b2039cb1
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2025

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f8be3aac-9b8c-4f39-af82-893fae5fb909/qilin-ransomware-surges-to-101-incidents-targeting-industrial-sectors.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup