Attack Chain

1. Initial Access: Attackers gain entry through various methods, including the exploitation of public-facing applications, spearphishing via email, or leveraging valid but compromised accounts (e.g., T1566, T1190, T1078).
2. Execution: Qilin operators execute malicious code using scripting interpreters like PowerShell or Unix Shell, or by deploying malicious system services (e.g., T1059.001, T1059.004, T1569.002).
3. Persistence & Privilege Escalation: Persistence is established via scheduled tasks or boot/logon autostart execution. Privilege escalation is achieved through exploitation of vulnerabilities or techniques like OS credential dumping (e.g., T1053.005, T1547, T1068, T1003.001).
4. Defense Evasion: The group employs techniques such as obfuscated files, modifying or disabling security tools, and impairing system defenses like firewalls to maintain access and avoid detection (e.g., T1027, T1562, T1562.004).
5. Discovery & Lateral Movement: Attackers conduct extensive network reconnaissance, querying registries, sniffing network traffic, and using remote services (e.g., SMB/Windows Admin Shares, RDP) to identify high-value targets and move laterally across the compromised network (e.g., T1012, T1046, T1021.001, T1021.002).
6. Collection & Exfiltration: Sensitive data is collected and often archived using utilities before being exfiltrated over alternative network mediums or to cloud storage services (e.g., T1560.001, T1041, T1567.002).
7. Command and Control: Communication with C2 infrastructure is maintained through various methods, including obfuscated data and tunneling over common application layer protocols like web protocols (e.g., T1001, T1071.001, T1572).
8. Impact: The final stage involves encrypting victim data, inhibiting system recovery mechanisms, and sometimes wiping disks to maximize disruption and coerce ransom payment (e.g., T1486, T1490, T1488, T1488.001).

Impact

The Qilin ransomware group's attacks result in severe operational disruption, data loss due to encryption, and potential public exposure of sensitive information through their double extortion model. With over 2000 victims reported since 2022, including a recent target in the US Agriculture and Food Production sector, the scope of their impact is significant and spans diverse industries like manufacturing, business services, technology, and healthcare. Successful attacks lead to direct financial losses from ransom demands, costs associated with incident response and recovery, and severe reputational damage. The loss of critical business data and systems can halt operations for extended periods, impacting supply chains and essential services.

Recommendation

• Implement endpoint detection and response (EDR) solutions to detect and block malicious hashes listed in the IOCs.
• Block connections to the malicious IP addresses and domains listed in the IOC table at the network perimeter firewall and DNS resolver.
• Deploy and tune endpoint security rules, such as the Detect Qilin Ransomware Hashes rule, to identify and quarantine known Qilin ransomware samples.
• Implement and continuously monitor the Detect Qilin C2 Network Connections rule to identify and alert on suspicious outbound network activity to known Qilin infrastructure.
• Enable comprehensive logging for process creation, network connections, and file events on all endpoints to provide visibility for the detection rules and facilitate incident response.
• Review and enforce strong password policies and multi-factor authentication (MFA) to mitigate initial access attempts via valid accounts (ATT&CK T1078).
• Regularly patch and update all public-facing applications and systems to prevent exploitation of vulnerabilities (ATT&CK T1190).

Impact

Successful exploitation of CVE-2026-6875 could allow an attacker to bypass the security restrictions of the ServiceNow AI Platform's sandbox environment. This could lead to unauthorized access to sensitive data, execution of arbitrary code outside the sandbox, or escalation of privileges on the affected ServiceNow instance. While no specific victims or attack campaigns have been detailed in the advisory, any organization using the vulnerable versions of ServiceNow Brazil, Australia, Zurich, or Yokohama platforms is at risk of severe impact, including data breaches, system integrity compromise, and operational disruption if the vulnerability is exploited by a malicious actor.

Recommendation

• Review the ServiceNow Security Advisory (KB3137947) linked in this brief immediately to understand the specific affected versions and apply the necessary patches for CVE-2026-6875.
• Apply the recommended updates to your ServiceNow Brazil instances (prior to Brazil EA and Brazil GA), Australia instances (prior to Australia Patch 2), Zurich instances (prior to Zurich Patch 7b and Zurich Patch 9), and Yokohama instances (prior to Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13).
• Ensure that all ServiceNow platforms are kept up-to-date with the latest security patches to mitigate known vulnerabilities.

Attack Chain

1. The attacker gains initial access to a compromised host within the network.
2. The attacker crafts a malicious DNS query containing marshaled CREDENTIAL_TARGET_INFORMATION structures.
3. The compromised host sends the malicious DNS query to the internal DNS server.
4. The DNS server processes the query, unknowingly forwarding the malicious data.
5. The attacker intercepts the DNS response and uses the spoofed SPN to initiate a Kerberos authentication request.
6. The target server authenticates to the attacker-controlled service, relaying credentials.
7. The attacker leverages the relayed credentials to gain unauthorized access to network resources.
8. The attacker escalates privileges and moves laterally within the network, achieving their final objective.

Impact

A successful Kerberos coercion attack can lead to significant compromise of a network. By relaying credentials, attackers can gain unauthorized access to critical systems and data. While the exact number of potential victims is unknown, the impact can range from data breaches to complete network takeover. Sectors relying on Kerberos for authentication, such as government, finance, and healthcare, are particularly vulnerable. Successful exploitation allows attackers to escalate privileges, move laterally, and ultimately achieve their objectives, including data exfiltration or ransomware deployment.

Recommendation

• Ensure that DNS data is properly ingested and correlated with the Network Resolution data model in your SIEM to facilitate detection using the provided search query.
• Implement the provided Sigma rules to detect suspicious DNS queries containing marshaled credential structures based on Suricata and Sysmon event ID 22 logs.
• Investigate and patch CVE-2025-33073 on all affected systems to prevent exploitation of the vulnerability.
• Review and tune the provided Sigma rules for false positives, filtering as needed for your organization's specific environment based on the known false positives.
• Enable Sysmon Event ID 22 logging to enhance visibility into DNS query activity on Windows endpoints.

Attack Chain

1. The attacker identifies a vulnerable Fortinet appliance exposed to the internet.
2. The attacker crafts a malicious HTTP request to the /api/v2/cmdb/system/admin endpoint, bypassing authentication checks.
3. The attacker uses the PUT or POST HTTP methods to modify existing administrator accounts or create new accounts.
4. The attacker adds an SSH key to an administrator account to gain persistent remote access.
5. The attacker uses the newly created or modified administrator account to log into the Fortinet appliance's web interface or SSH.
6. The attacker reconfigures firewall rules to allow unauthorized network traffic.
7. The attacker exfiltrates sensitive data from the network through the compromised Fortinet appliance.
8. The attacker uses the compromised appliance as a pivot point to access other internal systems.

Impact

Successful exploitation of CVE-2022-40684 can lead to complete compromise of the Fortinet appliance and the network it protects. Attackers can gain unauthorized access to sensitive data, disrupt network services, and use the compromised appliance as a foothold for further attacks within the network. This vulnerability has been widely exploited, impacting numerous organizations across various sectors. Unpatched systems are at high risk of being compromised.

Recommendation

• Apply the latest Fortinet patches to address CVE-2022-40684 on all FortiOS, FortiProxy, and FortiSwitchManager appliances immediately.
• Deploy the Sigma rule Fortinet Appliance Auth Bypass Attempt to your SIEM to detect exploitation attempts targeting the /api/v2/cmdb/system/admin endpoint.
• Enable web server logging on Fortinet appliances to ensure the Sigma rule can effectively detect malicious activity.
• Review existing user accounts and SSH keys for any unauthorized additions or modifications.
• Monitor network traffic for suspicious outbound connections originating from Fortinet appliances.
• Implement network segmentation to limit the impact of a successful breach.