Xcitium Logo

Zero-Dwell Threat Intelligence Reports

Qilin Drops Extension “xGbhrRkvXs” and Uses Restart Manager for Process Killing.exe
detect-debug-environment
Qilin Ransomware Sample Surfaces With Tor Negotiation Flow and Hardened Filecoder Pipeline.exe
detect-debug-environment
Qilin Surfaces With Full Tor Negotiation Config and Aggressive Filecoder Behavior.exe
detect-debug-environment
Qilin Loader Variant Uses Embedded RSA Key and System Enumeration for Targeted Impact.exe
detect-debug-environment checks-user-input spreader
AnonBit MSIL Ransomware Builder Shows Chaos-Family Traits and Embedded BlackMatter Metadata.exe
idle spreader assembly obfuscated
LockBit Variant Surfaces With Full Ransom Note Infrastructure and Stealthy Spread Behavior.exe
long-sleeps overlay persistence checks-usb-bus
High-Severity BQTLock Strain Uses Multi-Channel C2 and Hardened Encryption Workflow.exe
64bits overlay idle
Agenda/Qilin Build Shows Restart Manager Abuse and Veeam-Linked Indicators.exe
detect-debug-environment
Qilin Loader Shows Embedded RSA Key, Process Enumeration, and Enterprise Targeting.exe
overlay detect-debug-environment checks-user-input
Qilin Ransomware Loader Shows High-Entropy Packing and Spreader Capabilities.exe
detect-debug-environment checks-user-input spreader
Agenda/Qilin Strain Shows Veeam-Targeting Indicators and Full Double-Extortion Payload.exe
detect-debug-environment
BQTLock 64-Bit Ransomware Variant Leveraging Telegram Bots and Discord C2 Emerges.exe
64bits overlay idle