Full Report
Incident analysis is critical, but for newcomers, it can be daunting. Learn how to confirm commands, validate findings, and spot real impact during a Qilin ransomware event.
Analysis Summary
# Incident Report: Qilin Ransomware Post-Incident Analysis
## Executive Summary
This report details a Qilin ransomware incident where security analysts gained visibility only after the Huntress agent was installed post-compromise on a single endpoint. The attackers utilized rogue remote monitoring and management (RMM) tools and PowerShell scripts to harvest credentials and prepare for ransomware deployment. Despite limited "pinhole" visibility, analysts successfully reconstructed the attack chain, though the organization had already suffered infection prior to agent deployment.
## Incident Details
- **Discovery Date:** October 11, 2025
- **Incident Date:** October 2, 2025 – October 11, 2025
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** October 2, 2025 (Initial suspicious file detection)
- **Vector:** Likely disguised software download/Social Engineering.
- **Details:** Windows Defender flagged `LogMeIn Client.exe` in the downloads folder, but no further action was taken.
### Lateral Movement
- **Date/Time:** October 8, 2025
- **Details:** The threat actor accessed the endpoint to install "Total Software Deployment Service" and a rogue ScreenConnect instance (`LogmeinClient.msi`) pointing to `94.156.232[.]40`.
### Data Exfiltration/Impact
- **Date/Time:** October 11, 2025
- **Details:** The endpoint was fully compromised by Qilin ransomware. A ransom note was dropped, and Managed Antivirus (MAV) alerts were triggered.
### Detection & Response
- **Discovery:** October 11, 2025, following the post-incident installation of the Huntress agent.
- **Response Actions:** Huntress SOC analyzed Event Logs and MAV alerts; recovered malicious PowerShell scripts (`r.ps1`) used for credential harvesting.
## Attack Methodology
- **Initial Access:** Disguised installers (LogMeIn client masquerade).
- **Persistence:** Installation of rogue ScreenConnect RMM instance.
- **Privilege Escalation:** Not specifically detailed, but utilized `administrator` paths.
- **Defense Evasion:** Renaming rogue ScreenConnect installers to `LogmeinClient.msi` to blend in with legitimate software.
- **Credential Access:** Execution of `r.ps1` to extract RDP authentication details from `Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational` logs.
- **Discovery:** Use of Total Software Deployment Service for network-wide visibility.
- **Lateral Movement:** ScreenConnect remote access.
- **Collection:** Automated script-based harvesting of Event Log data.
- **Exfiltration:** Not explicitly detailed in the "pinhole" view, though staging was evident.
- **Impact:** Qilin Ransomware encryption and ransom note deployment.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Compromise of RDP session history and potential administrative credentials.
- **Operational:** System encryption leading to local downtime.
- **Reputational:** Not disclosed.
## Indicators of Compromise
- **Network Indicators:** `94.156.232[.]40` (Rogue ScreenConnect C2)
- **File Indicators:**
- `r.ps1` (Credential harvesting script)
- `s.exe`, `ss.exe` (Transferred via RMM)
- `LogmeinClient.msi` (Rogue installer in `AppData\Roaming\Installer`)
- **Behavioral Indicators:** Unsolicited installation of deployment tools; execution of PowerShell queries against Terminal Services operational logs.
## Response Actions
- **Containment:** Isolation of the infected endpoint following post-incident agent installation.
- **Eradication:** Removal of rogue ScreenConnect and deployment services.
- **Recovery:** Restoration of systems from backups (presumed).
## Lessons Learned
- **Visibility Gaps:** Lack of EDR/SIEM prior to the attack allowed the threat actor to persist for 9 days undetected.
- **Alert Fatigue/Ignored Warnings:** The initial detection of a suspicious file by Windows Defender on October 2nd was not triaged, allowing the infection to proceed.
- **RMM Abuse:** Attackers continue to successfully use legitimate RMM tools (ScreenConnect) to bypass traditional security filters.
## Recommendations
- **Deployment:** Ensure EDR/MDR coverage across 100% of endpoints to avoid "pinhole" visibility issues.
- **Software Restriction:** Implement application blocklists or whitelists to prevent the unauthorized installation of RMM tools like ScreenConnect or LogMeIn.
- **Log Monitoring:** Centralize Windows Event Logs and alert on Event ID 1149 (RDP Authentication) when queried by non-standard processes.
- **Response Protocol:** Establish a formal process for investigating "No Action Taken" alerts from Windows Defender.