Threat Intelligence and Security Incidents
New Qilin.B ransomware variant emerges with upgraded encryption and evasion capabilities
▌The New Threat of Qilin.B Ransomware
A new, upgraded version of the Qilin ransomware, Qilin.B, has emerged with highly sophisticated evasion and encryption tactics. This variant utilizes advanced AES-256-CTR encryption for systems with AESNI capabilities, while continuing to leverage Chacha20 for systems without AESNI support. More critically, Qilin.B secures the encryption keys using the RSA-4096 algorithm combined with OAEP padding, which means decrypting the files is virtually impossible without the attacker's private key or a captured seed value.
▌Qilin.B Ransomware Upgrades to Rust, Increasing Security Risks
The Qilin ransomware (also known as Agenda) first emerged in the cybersecurity landscape between July and August 2022. Its initial versions were written in Golang, and subsequently transitioned to Rust.
A report from May 2023 indicated that this Ransomware-as-a-Service (RaaS) model allowed its affiliates to retain 80% to 85% of each ransom payment after penetrating target organizations and engaging with Qilin recruiters.
Recently, attacks associated with this ransomware have stolen credentials stored in Google Chrome from a small number of compromised endpoints, indicating that its tactics have drifted somewhat from traditional double-extortion attack models.
Analysis shows that the new version of Qilin (Qilin.B) has further enhanced its encryption capabilities on top of the original version and optimized its operational strategies. Specifically, it employs AES-256-CTR or Chacha20 for encryption and adopts various measures to bypass analysis and detection, such as terminating services associated with security tools, continuously clearing Windows Event Logs, and implementing self-deletion.
Additionally, Qilin.B features the ability to terminate processes associated with backup and virtualization services and delete volume shadow copies, which significantly increases the difficulty of data recovery.
By combining stronger encryption mechanisms, effective defense evasion tactics, and persistent disruption to backup systems, Qilin.B has become an extremely dangerous ransomware variant.
The evolving tactics of ransomware groups fully reveal the malicious and persistent nature of ransomware threats. This is demonstrated by the newly discovered Rust-based toolkit, which is not only used to propagate the emerging Embargo ransomware but also, prior to this, leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to quietly terminate Endpoint Detection and Response (EDR) systems installed on host machines.
Notably, both this EDR killer, named MS4Killer (so called due to its similarity to the open-source tool s4killer), and the ransomware itself are executed via a malicious loader called MDeployer.
▌Rust Powers Embargo Ransomware Attacks, Healthcare Organizations Face Hefty Ransoms
MDeployer is the primary malicious loader deployed by Embargo in compromised networks to assist in the attack chain, ultimately leading to the execution of the ransomware and file encryption, while MS4Killer is designed to run continuously. All three—MDeployer, MS4Killer, and the ransomware payload—are written in Rust, showing that Rust is the programming language of choice for the group's developers.
According to data released by Microsoft, 389 healthcare institutions in North America suffered ransomware attacks this year, with system downtime costing these institutions up to $900,000 per day. Among them, ransomware gangs such as Lace Tempest, Sangria Tempest, Cadenza Tempest, and Vanilla Tempest have targeted hospitals and have been particularly rampant.
Among the 99 healthcare organizations that admitted to paying a ransom and disclosed the specific amount, the median payment was $1.5 million, while the average payment reached $4.4 million.
▌Security validation rules
To address this threat group, the Cyber Security Measure Validation Platform has added the corresponding attack simulation rules. You can search for the keyword "Qilin" on the platform to obtain attack simulation validation actions related to this ransomware. Through these simulated attacks, you can verify whether your security defense system can effectively counter attacks from this threat group. The Cyber Security Measure Validation Platform utilizes an industry-unique method to ensure your validation process is safe and harmless.
