Qilin RaaS Expands Global Impact: 40+ Victims/Month, Cyberduck Abuse, and WDigest Credential Theft

According to Cisco Talos, Qilin ransomware group has sustained a high operational tempo in the second half of 2025, publishing over 40 victim cases per month on its leak site and remaining one of the most impactful ransomware groups worldwide. Active since mid-2022, Qilin operates as a ransomware-as-a-service (RaaS) model, supplying affiliates with malware platforms and playbooks, and employs a double-extortion approach to pressure victims.

The attackers gained entry by abusing exposed administrative credentials leaked on the dark web, often in cases where MFA was absent and NTLM authentication attempts were made against VPNs. They later moved laterally using RDP, PsExec, and stolen credentials, and used a batch file that enabled plaintext credential storage by altering the WDigest registry key, with tools like Mimikatz, NirSoft, and SharpDecryptPwd then extracting passwords from various applications.

Cisco Talos notes that Cyberduck was used to exfiltrate archives to Backblaze cloud storage, highlighting a growing use of legitimate cloud tools to mask theft, while the United States remains the most affected country, followed by the United Kingdom.