Medical IoT Under Fire: How Ransomware Groups Exploit Connected Healthcare Devices

The Hospital Is Already Compromised

On July 26, 2026, cybercriminals hit AnMed, a nonprofit health system serving South Carolina and Georgia, with a malware attack that breached patient health information and continues to disrupt care weeks later [4]. A group identifying itself as The Gentlemen ransomware gang claimed responsibility [4]. In late May 2026, Qilin ransomware affiliates burned through 15 victims in 48 hours, with healthcare organizations comprising 30% of their targets: Mindpath College Health, Providence Medical Group, and Dillon Family Medicine all got hit [3].

These aren't isolated events. They're the consequence of an attack surface that's grown faster than most hospital security programs can manage.

Why Medical IoT Attracts Ransomware Operators

Ransomware operators target healthcare because organizations in this sector face extraordinary pressure to restore operations. Patient care depends on constant access to clinical data. Downtime creates safety risks. That pressure translates directly into willingness to pay ransoms.

The double-extortion playbook is standard now. As Rebecca Moody of Comparitech noted regarding The Gentlemen's operations: "Many ransomware groups, like The Gentlemen, will ensure they've stolen data before they start encrypting systems" [4]. Steal patient records first, encrypt systems second, then demand payment to both decrypt and suppress publication. Healthcare data carries outsized value on criminal marketplaces because it contains dense PII: Social Security numbers, insurance details, medical histories, and billing records.

Qilin's May 2026 campaign illustrates the operational tempo. Their affiliates appear to operate with short dwell times between initial access and detonation, a rapid approach that gives defenders minimal time to detect and respond [3].

The Medical Device Attack Surface

On August 6, 2026, CISA released ICS Medical Advisories covering vulnerabilities in Medixant RadiAnt DICOM, a widely used medical imaging software [1]. Separately, CISA also released ICS Advisories covering ABB Ability Zenon and Johnson Controls TL280. The medical device vulnerabilities could enable remote code execution, denial of service, and unauthorized access [1]. CISA's decision to categorize RadiAnt DICOM under ICS Medical Advisories reflects the direct patient care implications: exploitation could lead to treatment delays or leakage of patient imaging data [1].

This is a single week's disclosure. Medical devices ship with long lifecycles, slow patch cycles, and clinical environments where downtime for updates conflicts directly with patient care workflows. The result is an enormous population of devices running known-vulnerable software for months or years after patches become available.

Exploiting Internet-Facing Services

Qilin affiliates reportedly rely on exploiting internet-facing applications, including ConnectWise ScreenConnect, Microsoft Exchange, and VPN appliances [3]. They also brute-force RDP and VPN endpoints exposed to the public internet and run credential harvesting phishing campaigns [3]. Once inside, they reportedly use Cobalt Strike beacons for lateral movement and Living off the Land Binaries (LOLBins) to avoid detection [3].

Unencrypted Device Communications

A 2025 academic study demonstrated the practical risk of unencrypted medical IoT communications by building a prototype monitoring device using a NodeMCU ESP8266 with heart rate and temperature sensors [2]. Researchers successfully intercepted and manipulated unencrypted patient data transmissions in real time using Bettercap and Wireshark [2]. The man-in-the-middle attack worked trivially against the unencrypted channel.

When the researchers applied AES-128 encryption, all intercepted data became unreadable and tamper attempts failed [2]. The performance cost was modest: latency increased from 80ms to 125ms (56.25%), and CPU usage rose from 30% to 45%, without affecting system stability [2]. The total device cost stayed under $12 [2]. We assess that the barrier to securing these devices is primarily organizational rather than technological.

Lateral Movement Inside Clinical Networks

Once ransomware operators establish a foothold, they move laterally using standard administrative tools. Qilin affiliates have been observed using psexec.exe, psexec64.exe, wmic.exe, and mstsc.exe for lateral movement across victim networks [3]. They reportedly exfiltrate data using tools like Rclone or Mega before detonation [3]. These are all legitimate tools that blend into normal administrative activity, making detection dependent on behavioral analysis rather than signature matching.

IOC Table

MITRE ATT&CK Mapping

Lateral Movement via PsExec and WMIC

Qilin's reliance on psexec.exe, psexec64.exe, and wmic.exe for lateral movement creates detectable patterns [3]. Monitor for:

• Process creation events where psexec.exe or psexec64.exe spawns child processes on remote systems
• wmic.exe invocations with /node: parameters targeting remote hosts
• Unexpected mstsc.exe (Remote Desktop) connections originating from servers rather than admin workstations

title: Suspicious PsExec or WMIC Remote Execution in Healthcare Environment
id: a3c7f1e2-9d84-4b56-b3e2-1f5a8c6d7e09
status: experimental
description: Detects PsExec or WMIC used for potential lateral movement
author: RedSheepSec
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: '/node:'
  condition: selection_psexec or selection_wmic
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
falsepositives:
  - Legitimate system administration

Data Exfiltration via Rclone or Mega

Qilin affiliates reportedly use Rclone and Mega for exfiltration prior to encryption [3]. Hunt for:

• rclone.exe process executions, especially with copy or sync subcommands targeting cloud storage
• Outbound connections to mega.nz or mega.co.nz from servers that don't normally access cloud storage
• Large-volume outbound data transfers from clinical network segments

Medical Device Network Anomalies

Given CISA's August 2026 advisory on RadiAnt DICOM and related medical device vulnerabilities [1], defenders should monitor for:

• Unexpected outbound connections from DICOM servers or medical imaging workstations
• Network traffic from medical device VLANs to internet-facing endpoints
• Anomalous authentication attempts against medical device management interfaces

Analysis

The current threat picture for healthcare IoT is defined by two converging pressures. First, ransomware groups are specifically selecting healthcare targets with full knowledge that clinical operations create urgency to pay. Qilin devoted 30% of a 48-hour attack wave to healthcare organizations [3]. The Gentlemen's attack disrupted AnMed operations for weeks, with facilities remaining closed well into August [4]. These groups understand that healthcare downtime has patient safety consequences and likely plan their operations accordingly.

Second, the medical device ecosystem remains structurally difficult to defend. CISA is issuing advisories on medical imaging software vulnerabilities that could affect patient care [1], but the patch-to-deployment cycle in clinical environments is measured in months, not days. Academic research confirms that even basic protections like AES-128 encryption on $12 devices are feasible but remain unimplemented in practice [2].

The attackers' tool choices tell a story about defender maturity. Qilin affiliates don't need sophisticated custom malware. PsExec, WMIC, and RDP are sufficient to traverse most healthcare networks [3]. We assess this reflects network segmentation and monitoring gaps across the sector rather than a limitation of attacker capability.

References

1. Security News Daily Report 2026-08-08 - Device Security Lab
2. Smart Medical IoT Security Vulnerabilities: Real-Time MITM Attack Analysis (arXiv)
3. QILIN Ransomware: 15+ Victims in 48-Hour Blitz - Security Arsenal
4. Patient data was breached in AnMed attack - Healthcare IT News

Hunt Guide: Qilin & The Gentlemen Ransomware Targeting Healthcare IoT and Clinical Networks

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If Qilin or The Gentlemen ransomware affiliates are active in our environment, we expect to observe PsExec/WMIC-based lateral movement, Rclone or Mega-based data exfiltration, Cobalt Strike beacon activity, and exploitation of internet-facing services (VPN, RDP, Exchange, ScreenConnect) in endpoint, network, and authentication logs across clinical and administrative network segments.

Intelligence Summary: Multiple ransomware-as-a-service groups are actively targeting healthcare organizations with double-extortion campaigns. Qilin affiliates burned through 15 victims in 48 hours in late May 2026, with 30% being healthcare targets, using PsExec, WMIC, RDP for lateral movement and Rclone/Mega for exfiltration. The Gentlemen ransomware gang claimed responsibility for the July 26, 2026 AnMed attack that breached patient health information and disrupted care for weeks. CISA issued ICS Medical Advisories on August 6, 2026 covering vulnerabilities in Medixant RadiAnt DICOM medical imaging software that could enable remote code execution and unauthorized access.

Confidence: Moderate | Priority: Critical

Scope

• Networks: All clinical network segments including medical device VLANs, DICOM/PACS networks, administrative networks, and internet-facing DMZ segments hosting VPN, Exchange, and remote access services. Include any segments hosting ConnectWise ScreenConnect instances.
• Timeframe: 90-day retrospective hunt window (late May 2026 through present) to cover the Qilin 48-hour blitz campaign timeframe, The Gentlemen's AnMed attack on July 26, and CISA's August 6 ICS Medical Advisory. Ongoing monitoring recommended.
• Priority Systems: DICOM/PACS imaging servers, medical device management systems, internet-facing VPN concentrators, Exchange servers, ConnectWise ScreenConnect instances, domain controllers, file servers containing patient data, and any systems in medical device VLANs with external connectivity.

MITRE ATT&CK Techniques

T1021.002 — Remote Services: SMB/Windows Admin Shares (Lateral Movement) [P2]

Qilin affiliates use psexec.exe and psexec64.exe for lateral movement across victim healthcare networks, spawning child processes on remote systems via SMB/Admin shares.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 (Image="*\\psexec.exe" OR Image="*\\psexec64.exe" OR OriginalFileName="psexec.c") | eval timestamp=_time | stats count earliest(timestamp) as first_seen latest(timestamp) as last_seen values(CommandLine) as commands values(ParentImage) as parent_processes by Computer, User, Image | where count > 0 | sort - count | table Computer, User, Image, commands, parent_processes, count, first_seen, last_seen

Elastic KQL:

(process.name:"psexec.exe" OR process.name:"psexec64.exe" OR process.pe.original_file_name:"psexec.c") AND event.category:"process"

Sigma Rule:

title: Suspicious PsExec Execution in Healthcare Environment
id: a3c7f1e2-9d84-4b56-b3e2-1f5a8c6d7e09
status: experimental
description: Detects PsExec execution commonly used by Qilin ransomware affiliates for lateral movement in healthcare networks
author: RedSheepSec
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_pipe:
    OriginalFileName: 'psexec.c'
  condition: selection_psexec or selection_pipe
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.002
falsepositives:
  - Legitimate system administration using PsExec
  - IT helpdesk remote support activities

Tune by baselining legitimate PsExec usage by IT administrators. Alert on PsExec executions from non-admin workstations, from medical device VLANs, or outside business hours. Correlate with Sysmon EventID 17/18 for PSEXESVC named pipe creation on target systems.

T1047 — Windows Management Instrumentation (Execution) [P2]

Qilin affiliates use wmic.exe with /node: parameters to execute commands on remote hosts for lateral movement across healthcare networks.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 Image="*\\wmic.exe" CommandLine="*/node:*" | rex field=CommandLine "/node:(?<target_host>[^\s]+)" | stats count values(CommandLine) as commands values(target_host) as targets by Computer, User | where count > 0 | sort - count | table Computer, User, targets, commands, count

Elastic KQL:

process.name:"wmic.exe" AND process.command_line:*\/node\:*

Sigma Rule:

title: Remote WMIC Execution Indicative of Lateral Movement
id: b4d8e2f3-ae95-4c67-c4f3-2g6b9d7e8f10
status: experimental
description: Detects WMIC with /node parameter targeting remote hosts, a technique used by Qilin ransomware affiliates
author: RedSheepSec
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: '/node:'
  condition: selection
level: medium
tags:
  - attack.execution
  - attack.t1047
  - attack.lateral_movement
falsepositives:
  - Legitimate remote administration
  - SCCM/ConfigMgr operations

WMIC with /node: is a strong lateral movement indicator when originating from non-admin systems. Cross-reference source hosts against known admin workstations. Note: wmic.exe is deprecated in newer Windows versions, so its presence on modern systems may itself be suspicious.

T1486 — Data Encrypted for Impact (Impact) [P1]

Both Qilin and The Gentlemen ransomware groups encrypt victim systems after data exfiltration as part of double-extortion campaigns targeting healthcare organizations.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=11 (TargetFilename="*.encrypted" OR TargetFilename="*.locked" OR TargetFilename="*.qilin" OR TargetFilename="*.agenda" OR TargetFilename="*.ransom") | stats count dc(TargetFilename) as unique_files by Computer, Image | where unique_files > 10 | sort - unique_files | table Computer, Image, unique_files, count

Elastic KQL:

(file.extension:"encrypted" OR file.extension:"locked" OR file.extension:"qilin" OR file.extension:"agenda") AND event.category:"file"

Sigma Rule:

title: Mass File Encryption Indicative of Ransomware Activity
id: c5e9f3g4-bf06-5d78-d5g4-3h7c0e8f9g21
status: experimental
description: Detects rapid creation of files with ransomware-associated extensions potentially linked to Qilin or other ransomware groups
author: RedSheepSec
date: 2026/08/26
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.encrypted'
      - '.locked'
      - '.qilin'
      - '.agenda'
  condition: selection
level: critical
tags:
  - attack.impact
  - attack.t1486
falsepositives:
  - Legitimate encryption software
  - Backup encryption tools

This is a late-stage indicator. Pair with earlier-stage detections (lateral movement, exfiltration) for maximum effectiveness. High volume of file creation events with unusual extensions in a short timeframe is the key signal. Also monitor for vssadmin.exe or wmic.exe deleting shadow copies (T1490) which typically precedes encryption.

T1567.002 — Exfiltration Over Web Service: Exfiltration to Cloud Storage (Exfiltration) [P1]

Qilin affiliates reportedly use Rclone and Mega for data exfiltration prior to ransomware detonation as part of their double-extortion playbook.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 (Image="*\\rclone.exe" OR CommandLine="*rclone*" OR CommandLine="*mega*") | stats count values(CommandLine) as commands values(ParentImage) as parent by Computer, User, Image | sort - count | table Computer, User, Image, commands, parent, count

Elastic KQL:

(process.name:"rclone.exe" OR process.command_line:*rclone* OR process.command_line:*mega*) AND event.category:"process"

Sigma Rule:

title: Rclone or Mega Exfiltration Tool Execution
id: d6f0g4h5-cg17-6e89-e6h5-4i8d1f9g0h32
status: experimental
description: Detects execution of Rclone or references to Mega cloud storage, tools reportedly used by Qilin ransomware for pre-encryption data exfiltration
author: RedSheepSec
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
  selection_rclone_cmd:
    CommandLine|contains:
      - 'rclone'
      - '--config'
      - 'copy'
      - 'sync'
  selection_mega:
    CommandLine|contains:
      - 'mega.nz'
      - 'mega.co.nz'
      - 'megacmd'
      - 'MEGAclient'
  condition: selection_rclone or (selection_rclone_cmd and selection_mega) or selection_mega
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
falsepositives:
  - Legitimate cloud backup operations using Rclone
  - Approved Mega usage

Rclone is rarely used legitimately in enterprise healthcare environments. Any execution should be investigated. Also hunt for DNS queries to mega.nz and mega.co.nz from servers or clinical network segments. Monitor for large outbound data transfers coinciding with Rclone execution.

T1210 — Exploitation of Remote Services (Lateral Movement) [P2]

Qilin affiliates reportedly exploit internet-facing applications including ConnectWise ScreenConnect, Microsoft Exchange, and VPN appliances as initial access vectors.

Splunk SPL:

index=firewall-pan sourcetype="pan:threat" (dest_port=443 OR dest_port=8040 OR dest_port=8041) (app="ssl" OR app="web-browsing") action="alert" | stats count by src_ip, dest_ip, dest_port, threat_name | where count > 3 | sort - count | table src_ip, dest_ip, dest_port, threat_name, count

Elastic KQL:

event.category:"intrusion_detection" AND (destination.port:443 OR destination.port:8040 OR destination.port:8041) AND event.action:"alert"

Focus on exploitation attempts against Exchange (CVE patterns), ScreenConnect (port 8040/8041), and VPN appliances. Cross-reference source IPs against threat intelligence feeds. Monitor for successful exploitation indicators such as webshell creation or anomalous service account activity post-exploitation.

T1021.001 — Remote Services: Remote Desktop Protocol (Lateral Movement) [P2]

Qilin affiliates use mstsc.exe (Remote Desktop) for lateral movement, and brute-force RDP endpoints exposed to the public internet for initial access.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 Image="*\\mstsc.exe" | eval is_server=if(match(Computer, "(?i)(srv|server|dc|sql|app|web|dicom|pacs)"), 1, 0) | where is_server=1 | stats count values(CommandLine) as commands values(ParentImage) as parent by Computer, User | sort - count | table Computer, User, commands, parent, count

Elastic KQL:

process.name:"mstsc.exe" AND (host.name:*srv* OR host.name:*server* OR host.name:*dc* OR host.name:*sql* OR host.name:*dicom* OR host.name:*pacs*)

Sigma Rule:

title: RDP Client Execution from Server System
id: e7g1h5i6-dh28-7f90-f7i6-5j9e2g0h1i43
status: experimental
description: Detects mstsc.exe execution from server systems which may indicate lateral movement by Qilin ransomware affiliates
author: RedSheepSec
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mstsc.exe'
  filter_workstation:
    Computer|contains:
      - 'WKS'
      - 'DESKTOP'
      - 'LAPTOP'
  condition: selection and not filter_workstation
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.001
falsepositives:
  - Legitimate server administration via RDP
  - Jump server usage

RDP from servers is unusual in most environments. Focus on mstsc.exe originating from clinical systems, DICOM/PACS servers, or medical device management systems. Also hunt for RDP brute-force attempts on external-facing endpoints using failed authentication events (4625).

T1110 — Brute Force (Credential Access) [P2]

Qilin affiliates reportedly brute-force RDP and VPN endpoints exposed to the public internet as an initial access vector.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4625 Logon_Type=10 | stats count dc(TargetUserName) as unique_users by IpAddress | where count > 20 | sort - count | table IpAddress, unique_users, count

Elastic KQL:

event.code:"4625" AND winlog.event_data.LogonType:"10" | stats count by source.ip

Threshold of 20 failed RDP logons from a single source IP is a starting point; tune based on environment. Also monitor VPN authentication logs for similar brute-force patterns. Correlate with successful logons (4624) following bursts of failures to identify successful brute-force.

T1071.001 — Application Layer Protocol: Web Protocols (Command and Control) [P2]

Qilin affiliates reportedly use Cobalt Strike beacons for command and control after initial compromise, communicating over HTTP/HTTPS.

Splunk SPL:

index=corelight sourcetype=corelight_http (uri="*/submit.php*" OR uri="*/__utm.gif*" OR uri="*/pixel*" OR uri="*/ca*" OR uri="*/dpixel*" OR uri="*jquery*.js*" OR uri="*/visit.js*") | stats count values(uri) as uris values(user_agent) as agents by id_orig_h, id_resp_h, id_resp_p | where count > 5 | sort - count | table id_orig_h, id_resp_h, id_resp_p, uris, agents, count

Elastic KQL:

(url.path:*submit.php* OR url.path:*__utm.gif* OR url.path:*pixel* OR url.path:*dpixel* OR url.path:*jquery*.js*) AND event.dataset:"zeek.http"

Cobalt Strike malleable C2 profiles vary significantly. These URI patterns are common defaults but sophisticated operators customize them. Supplement with JA3/JA3S fingerprinting of known Cobalt Strike TLS profiles. Monitor for periodic beaconing patterns (fixed intervals with jitter) in network metadata.

T1566 — Phishing (Initial Access) [P3]

Qilin affiliates reportedly run credential harvesting phishing campaigns as one of their initial access vectors targeting healthcare organizations.

Splunk SPL:

index=corelight sourcetype=corelight_dns query_type="A" | where NOT match(query, "\.(mil|gov|va\.gov|med\.va\.gov)$") | stats count by query, id_orig_h | where count > 50 | sort - count | table query, id_orig_h, count | head 50

Elastic KQL:

dns.question.type:"A" AND NOT dns.question.name:*.mil AND NOT dns.question.name:*.gov

This is a broad anomaly hunt for unusual DNS patterns that may indicate credential harvesting infrastructure. Pair with email security logs to identify phishing emails containing links to credential harvesting pages. Focus on newly registered domains contacted by clinical workstations.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 (Image="*\\psexec.exe" OR OriginalFileName="psexec.c") | stats count values(CommandLine) as commands values(ParentImage) as parent by Computer, User | table Computer, User, commands, parent, count

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 Image="*\\psexec64.exe" | stats count values(CommandLine) as commands values(ParentImage) as parent by Computer, User | table Computer, User, commands, parent, count

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 Image="*\\wmic.exe" CommandLine="*/node:*" | stats count values(CommandLine) as commands by Computer, User | table Computer, User, commands, count

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 Image="*\\mstsc.exe" | eval is_server=if(match(Computer, "(?i)(srv|server|dc|sql|app|web|dicom|pacs)"), 1, 0) | where is_server=1 | stats count values(CommandLine) as commands by Computer, User | table Computer, User, commands, count

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 (Image="*\\rclone.exe" OR CommandLine="*rclone*") | stats count values(CommandLine) as commands values(ParentImage) as parent by Computer, User | table Computer, User, commands, parent, count

YARA Rules

HUNT_Rclone_Exfiltration_Tool — Detects Rclone binary or configuration artifacts commonly used by Qilin ransomware affiliates for data exfiltration

rule HUNT_Rclone_Exfiltration_Tool
{
    meta:
        author = "RedSheepSec"
        description = "Detects Rclone binary or configuration artifacts used by Qilin ransomware for pre-encryption exfiltration"
        date = "2026-08-26"
        reference = "https://securityarsenal.com/blog/qilin-ransomware-15-victims-in-48-hour-blitz-us-healthcare-and-manufacturing-under-siege"
        threat = "Qilin Ransomware"

    strings:
        $rclone_str1 = "rclone" ascii wide nocase
        $rclone_str2 = "--config" ascii wide
        $rclone_str3 = "rclone.conf" ascii wide
        $mega_str1 = "mega.nz" ascii wide nocase
        $mega_str2 = "mega.co.nz" ascii wide nocase
        $cmd_copy = "copy" ascii wide
        $cmd_sync = "sync" ascii wide
        $pe_magic = { 4D 5A }

    condition:
        $pe_magic at 0 and ($rclone_str1 and ($cmd_copy or $cmd_sync)) or
        ($rclone_str3) or
        ($rclone_str1 and ($mega_str1 or $mega_str2))
}

HUNT_PsExec_Lateral_Movement — Detects PsExec binaries used by Qilin ransomware for lateral movement in healthcare networks

rule HUNT_PsExec_Lateral_Movement
{
    meta:
        author = "RedSheepSec"
        description = "Detects PsExec variants used by Qilin ransomware affiliates for lateral movement"
        date = "2026-08-26"
        reference = "https://securityarsenal.com/blog/qilin-ransomware-15-victims-in-48-hour-blitz-us-healthcare-and-manufacturing-under-siege"
        threat = "Qilin Ransomware"

    strings:
        $psexec1 = "PsExec" ascii wide
        $psexec2 = "psexec.c" ascii wide
        $psexec3 = "Sysinternals" ascii wide
        $psexec4 = "PSEXESVC" ascii wide
        $pe_magic = { 4D 5A }

    condition:
        $pe_magic at 0 and 2 of ($psexec1, $psexec2, $psexec3, $psexec4)
}

Suricata Rules

SID 2026001 — Detects DNS query for mega.nz domain associated with Qilin ransomware exfiltration

alert dns $HOME_NET any -> any 53 (msg:"HUNT - DNS Query to mega.nz - Possible Qilin Ransomware Exfiltration"; dns.query; content:"mega.nz"; nocase; classtype:policy-violation; sid:2026001; rev:1; metadata:created_at 2026_08_26, updated_at 2026_08_26;)

SID 2026002 — Detects DNS query for mega.co.nz domain associated with Qilin ransomware exfiltration

alert dns $HOME_NET any -> any 53 (msg:"HUNT - DNS Query to mega.co.nz - Possible Qilin Ransomware Exfiltration"; dns.query; content:"mega.co.nz"; nocase; classtype:policy-violation; sid:2026002; rev:1; metadata:created_at 2026_08_26, updated_at 2026_08_26;)

SID 2026003 — Detects potential Cobalt Strike default HTTP beacon URI patterns

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - Potential Cobalt Strike Beacon URI Pattern"; flow:established,to_server; http.uri; content:"/submit.php"; classtype:trojan-activity; sid:2026003; rev:1; metadata:created_at 2026_08_26, updated_at 2026_08_26;)

SID 2026004 — Detects potential Cobalt Strike pixel tracking URI pattern

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - Potential Cobalt Strike Pixel URI Pattern"; flow:established,to_server; http.uri; content:"/__utm.gif"; classtype:trojan-activity; sid:2026004; rev:1; metadata:created_at 2026_08_26, updated_at 2026_08_26;)

Data Source Requirements

Recommendations

• Deploy all Sigma detection rules from this hunt guide across Splunk and Elastic instances, with initial tuning to baseline legitimate PsExec and WMIC administrative usage within the first two weeks of deployment.
• Review CISA ICS Medical Advisory from August 6, 2026 for Medixant RadiAnt DICOM (cisa.gov/news-events/ics-medical-advisories) and apply vendor patches to all affected medical imaging systems. Where patching requires clinical downtime coordination, implement compensating network segmentation controls immediately.
• Audit all internet-facing services — specifically VPN concentrators, RDP endpoints, Microsoft Exchange servers, and ConnectWise ScreenConnect instances — for unpatched vulnerabilities and enforce multi-factor authentication on all external access points. Qilin's reported primary initial access vectors target exactly these services.
• Block or restrict Rclone execution across all endpoints via application control policies. Rclone is not a standard enterprise tool and its presence should trigger immediate investigation. If legitimate use cases exist, whitelist specific approved instances only.
• Deploy Suricata rules (SIDs 2026001-2026004) on network sensors to detect DNS queries to mega.nz/mega.co.nz and Cobalt Strike beacon URI patterns at the network layer.
• Conduct a network segmentation assessment specifically for medical device VLANs, ensuring DICOM/PACS servers and medical IoT devices cannot directly reach internet-facing endpoints. Implement microsegmentation where flat network architecture exists.
• Inventory all medical IoT devices transmitting data without encryption and prioritize deployment of transport-layer encryption (minimum AES-128). Research demonstrates this is feasible even on sub-$12 hardware with modest performance impact.
• Implement behavioral alerting for RDP (mstsc.exe) sessions originating from servers, domain controllers, or medical imaging systems rather than designated admin workstations — this pattern is strongly indicative of lateral movement.
• Establish an approved administrative tools baseline and alert on any PsExec, WMIC /node:, or Rclone execution outside that baseline, particularly during non-business hours or from clinical network segments.

Sources

• Security News Daily Report 2026-08-08 - Device Security Lab
• Smart Medical IoT Security Vulnerabilities: Real-Time MITM Attack Analysis (arXiv)
• QILIN Ransomware: 15+ Victims in 48-Hour Blitz - Security Arsenal
• Patient data was breached in AnMed attack - Healthcare IT News