qiulong

Executive Summary

Qiulong is a newly emerged ransomware group targeting Brazilian organizations with double extortion tactics and threats to publish sensitive victim data. They surfaced in April 2024, aiming for financial gain through ransom payments.

Goals & Targeting

The primary goal of Qiulong is financial gain via ransom payments. While specific targeted sectors have not been explicitly detailed, the targeting is geographically concentrated in Brazil, indicating potential language or cultural considerations. Victims are likely businesses that hold sensitive data and could be pressured into complying due to reputational damage risks.

Qiulong is a sophisticated ransomware group that has emerged in 2024, primarily targeting organizations in Brazil. Their modus operandi involves double extortion—encrypting victims' data and demanding ransoms while threatening to release sensitive personal information, such as identity documents of victims' family members, to increase pressure on their targets. The group's strategy indicates a clear focus on financial gain through coercive tactics, leveraging psychological warfare to ensure compliance with their demands.

Key Capabilities

• Double extortion tactics
• Ransomware deployment with encryption capabilities
• Sensitive information extraction and publication

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since their emergence in April 2024, Qiulong has targeted at least eight organizations within Brazil. Their campaigns involve identifying high-value assets for both encryption and data extraction, with a focus on pressuring victims through public humiliation tactics. Notable past operations include multiple extortion attempts, emphasizing quick actions and high-pressure demands to expedite payments.

IOC Patterns

• Encrypted files following specific naming conventions
• RDP brute-force attempts targeting Brazilian IP ranges
• Web-based communication channels for further instructions post-infection

Recommended Actions

• Implement multi-factor authentication for all RDP access points
• Monitor network traffic for anomalies, especially within the Brazilian sector
• Conduct regular backups of critical data and ensure they are offline and secure
• Train employees to recognize phishing attempts and suspicious emails

Suggested Tags