Uncovering Qilin attack methods exposed through multiple cases

In the second half of 2025, the ransomware group Qilin has been highly active, publishing over 40 victim cases monthly, primarily affecting the manufacturing sector. Some scripts used by the attackers suggest a possible Eastern European or Russian origin. Talos identified the open-source tool Cyberduck as a means for data exfiltration, alongside other tools like notepad.exe and mspaint.exe for accessing sensitive information. The group employs dual deployment methods for their ransomware, using encryptor_1.exe via PsExec and encryptor_2.exe for encrypting multiple network shares.