Qilin Ransomware Combines Linux Payload With BYOVD Exploit in Hybrid Attack

The Qilin ransomware group has emerged as a prominent and sophisticated cyber threat, claiming over 40 victims monthly since early this year, with peak activity in June, August, and September, primarily impacting manufacturing, professional services, and wholesale trade sectors across North America and Europe. The group employs advanced tactics, including leveraging leaked credentials, disabling security software, deploying a Linux ransomware variant on Windows systems, and specifically targeting Veeam backup infrastructure and hyperconverged platforms like Nutanix AHV. This escalating and adaptive threat underscores significant cybersecurity risks for institutional investors and their portfolio companies, particularly those operating in targeted critical industries.

Analysis

The Qilin ransomware group has demonstrated significant escalation, averaging over 40 victims monthly since early 2025, with peaks of 100 cases in June and 84 in August/September. This RaaS operation predominantly targets manufacturing (23%), professional and scientific services (18%), and wholesale trade (10%) across North America and Europe. The sustained high volume of attacks underscores a persistent and evolving threat to critical sectors.

Qilin employs sophisticated tactics, leveraging leaked administrative credentials for initial access and utilizing tools like Mimikatz for extensive credential harvesting and data exfiltration. A critical development is the strategic targeting of Veeam backup infrastructure to compromise disaster recovery capabilities, alongside the deployment of Linux ransomware variants on Windows systems using BYOVD techniques. The group has also expanded its focus to hyperconverged platforms, specifically Nutanix AHV.

These advanced and adaptive threats pose significant cybersecurity risks for institutional investors and their portfolio companies, particularly those in targeted industries. The involvement of products from companies like Google (GOOG, GOOGL) and Cloudflare (NET) in attack vectors, coupled with the direct targeting of Nutanix (NTNX) platforms, highlights evolving vulnerabilities. Enhanced cybersecurity diligence is crucial, with Cisco (CSCO) providing threat intelligence on such groups.

Key Decisions for Investors

• Conduct enhanced cybersecurity diligence on portfolio companies, particularly those in manufacturing, professional services, and wholesale trade sectors, to assess their resilience against advanced ransomware.
• Scrutinize the security posture of critical infrastructure, including Veeam backup systems and hyperconverged platforms like Nutanix AHV, within investment holdings.
• Evaluate third-party vendor risk, especially concerning products frequently exploited in attack chains, and consider the defensive capabilities of cybersecurity solution providers.
• Advise portfolio companies to prioritize robust credential management, multi-factor authentication, and advanced endpoint detection and response (EDR) to mitigate sophisticated attack vectors.