Qilin Ransomware Exploits MSPaint and Notepad to Locate Sensitive Files

Qilin ransomware, which emerged in July 2022, is described as a formidable threat that continues to post details of more than 40 victims per month on its public leak site, with the United States leading in victim count and the UK among enabled nations. According to Talos, the group has adopted a distinctive approach by abusing native Windows tools, specifically mspaint.exe and notepad.exe, to locate files containing sensitive data during intrusions.

The campaign targets manufacturing, professional and scientific services, and wholesale trade, with other sectors such as healthcare and education each representing around 5% of incidents. Victim reviews also reveal use of Cyberduck for exfiltration to cloud destinations and the deployment of a dual encryptor strategy spreading via PsExec and encrypting network shares from a central point.

Reports note credential access through tools like Mimikatz and NirSoft utilities, with threat actors leveraging VPN logins and sometimes lacking MFA, and observers caution that some attributions to Eastern Europe or Russian-speaking operators could be false flags.

The article, dated 27 October 2025, underscores the importance of asset inventory, privilege segmentation, and continuous monitoring of both common and uncommon application behaviours to defend against one of 2025’s most industrious ransomware adversaries.