Threat Intelligence Report February 4 - February 10 2025

Qilin Ransomware Group

Overview

The Red Piranha Team continuously monitors ransomware groups and underground cybercrime activity to track emerging threats. In recent investigations, we analysed a Qilin (Agenda) ransomware attack that leveraged VPN compromise, lateral movement, and advanced EDR evasion techniques to infiltrate corporate networks.

Qilin operates as a Ransomware-as-a-Service (RaaS), allowing affiliates to conduct attacks in exchange for a large percentage of ransom payments. This particular attack showcased sophisticated kernel exploitation techniques, including a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack to disable endpoint detection and response (EDR) solutions at the deepest levels of the Windows operating system.

Attack Chain Analysis

Initial Access: VPN Compromise & Covert Network Tunnelling

• First session lasted over six hours; a second session occurred later for an additional hour and a half.
• Indicates compromised credentials or stolen session tokens, allowing the attacker to bypass MFA or other security controls.

• Bypass firewalls and internal security controls.
• Access internal machines remotely via RDP and other remote tools.
• Exfiltrate data through encrypted tunnels, making detection harder.

Privilege Escalation & Lateral Movement

After securing a foothold, the attacker expanded access within the network using:

• Logged into additional systems using compromised credentials.
• Avoided detection by mimicking legitimate user activity.

• Used PsExec and Windows Management Instrumentation (WMI) to execute commands remotely.
• Reduced reliance on custom malware, making the attack harder to detect.

EDR Evasion: DLL Sideloading & Kernel Exploitation

Phase 1: DLL Sideloading Attack

• Normally, upd.exe loads a trusted DLL (avupdate.dll) for software updates.
• The attacker replaced this DLL with a malicious version, allowing them to execute arbitrary code.

• upd.exe executed avupdate.dll, which then:
• Loaded web.dat, an XOR-encoded payload containing a customised version of EDRSandblast, a known EDR-disabling tool.
• Performed anti-analysis checks to detect debuggers or virtual machines.

Phase 2: BYOVD Attack with TPwSav.sys

Instead of using a well-known vulnerable driver (which modern EDRs flag), the attacker introduced:

🔹 TPwSav.sys – A signed but vulnerable Windows driver originally developed for Toshiba laptop power-saving features.

• Compiled in 2015, still holds a valid signature.
• Allows direct kernel memory access.
• Undetected by most security solutions, unlike older exploited drivers.

Once loaded, the attacker hijacked the Windows Beep.sys driver, modifying its BeepDeviceControl function to execute malicious shellcode.

• Overwrote kernel memory to disable EDR hooks.
• Used MmMapIoSpace to read/write arbitrary memory.
• Hijacked IofCompleteRequest for kernel function execution.

• Removed kernel callback routines, cutting off EDR visibility.
• Disabled event tracing, blocking forensic tools from recording system activity.

Mitigations Against Qilin Ransomware

• Enforce Strong VPN Security – Require Multi-Factor Authentication (MFA) and geolocation-based restrictions to prevent unauthorised access.
• Monitor VPN & RDP Activity – Detect long-duration VPN sessions, logins from cloud-hosted IPs, and unusual RDP usage.
• Restrict RDP & Remote Access – Disable RDP where possible; otherwise, restrict by IP allowlists, enforce MFA, and limit admin privileges.
• Implement Network Segmentation – Prevent lateral movement by isolating critical systems and enforcing least privilege access.
• Use Endpoint Detection & Response (EDR) Policies – Deploy behaviour-based anomaly detection to identify suspicious process executions.
• Block Vulnerable Drivers (BYOVD Protection) – Enable Windows Defender Application Control (WDAC) and Hypervisor-Protected Code Integrity (HVCI) to block outdated or unsigned drivers.
• Harden Privileged Account Usage – Implement Privileged Access Management (PAM) and just-in-time (JIT) access to limit admin rights.
• Disable Unnecessary Windows Services & Tools – Block execution of PsExec, WMIC, PowerShell, and other remote admin tools where not needed.

IOCs

Hashes

IP:

DLS URLs

Ransomware Victims Worldwide

A recent ransomware analysis reveals that the United States remains the most heavily impacted nation, accounting for a staggering 66.41% of global incidents, highlighting its continued vulnerability to ransomware threats. Following this, Canada reported 10.69% of the attacks, emerging as another highly targeted region.

India and the United Kingdom also faced considerable exposure, reporting 3.05% and 3.82% of ransomware incidents, respectively. Italy experienced 2.29% of attacks, indicating an ongoing risk in the region. Meanwhile, Sweden recorded 1.53% of global ransomware cases.

Several other nations exhibited moderate levels of ransomware incidents, including Singapore, Brazil, Israel, Turkey, China, Mexico, Germany, Jamaica, Saudi Arabia, Switzerland, France, Australia, South Korea, Netherlands, and Japan, each reporting 0.76% of global ransomware cases.

This analysis underscores the persistent and widespread nature of ransomware attacks, with North America facing particularly high levels of risk. These findings highlight the critical need for robust cybersecurity measures, proactive defence strategies, and heightened vigilance across all sectors to counteract the increasing ransomware threat worldwide.