New Ransomware Tactic: Qilin’s Chrome Credential Heist – A Nightmare for Network Security!
The Qilin ransomware group has added a new tactic to their playbook, using a custom stealer to swipe account credentials stored in the Google Chrome browser. Sophos X-Ops observed this alarming shift, marking a new low for ransomware strategies.
Hot Take:
Just when you thought ransomware couldn’t get any sneakier, Qilin proves that cybercriminals are the ultimate overachievers, now stealing your Chrome credentials too! Time to revisit those password management strategies people!
Key Points:
- Qilin ransomware group uses compromised VPN credentials to infiltrate networks.
- After a period of dormancy, they move laterally and modify Group Policy Objects (GPOs) to deploy a custom stealer.
- The stealer targets Google Chrome credentials and saves them to a shared folder.
- Credentials are sent to Qilin’s command and control server, and traces are wiped clean.
- Qilin then deploys ransomware across all domain-connected machines.
Membership Required
You must be a member to access this content.