Qilin Ransomware - Disables Major EDR Solutions with DLL
Basically, Qilin ransomware uses a sneaky trick to turn off security software.
Qilin ransomware is using a malicious DLL to disable major EDR solutions. This sophisticated attack targets organizations' defenses, making them vulnerable to ransomware. Enhanced security measures are crucial to combat this threat.
What Happened
The Qilin ransomware group is evolving its tactics by deploying a sophisticated multi-stage infection chain. This attack utilizes a malicious DLL file, specifically msimg32.dll, which can disable over 300 endpoint detection and response (EDR) solutions from major security vendors. As organizations increasingly depend on EDR for enhanced visibility, threat actors are adapting by targeting these systems directly.
How It Works
The attack begins when a legitimate application, like FoxitPDFReader.exe, sideloads the malicious DLL instead of the genuine Windows library. This method helps the malware avoid immediate detection. The rogue DLL forwards API calls to the legitimate library, maintaining normal application behavior while executing its malicious code. The DLL contains an encrypted payload that executes in memory, avoiding detection by traditional security measures.
Who's Being Targeted
Qilin ransomware has claimed over 40 victims per month, making it one of the most active ransomware-as-a-service (RaaS) operations. Organizations that rely on EDR solutions are particularly at risk, as the malware specifically targets these defenses to facilitate ransomware deployment.
Signs of Infection
Indicators of compromise include:
- Unexpected DLL sideloading activity.
- Installation of suspicious drivers like rwdrv.sys and hlpdrv.sys.
- Any attempts to write to physical memory from user-mode processes.
How to Protect Yourself
To defend against this sophisticated threat, organizations should:
- Monitor for unusual DLL activity and driver installations.
- Implement multi-layered security solutions that can detect and respond to such advanced tactics.
- Regularly update and patch security software to ensure they can withstand attacks targeting their defenses.
Conclusion
The Qilin ransomware campaign illustrates a significant shift in tactics. By targeting EDR solutions directly, attackers can operate undetected long enough to deploy their ransomware payloads. Organizations must enhance their security measures and remain vigilant against these evolving threats.