TLDR Tech / InfoSec
Watch Guard! Qilin affiliate exploits network appliances for initial access
Ctrl-Alt-Intel tracked a Qilin RaaS affiliate across 5 exposed open-directories from August 2025 to March 2026, observing 1,929 exploit invocations against 918 unique WatchGuard Firebox IPs (71.5% Germany, 28.1% US) using watchTowr's CVE-2025-9242 POC, alongside POCs for CVE-2025-14733, CVE-2025-40554 (SolarWinds), CVE-2025-59718 (FortiOS), CVE-2025-60021 (Apache bRPC), CVE-2026-24061, and CVE-2026-24423. The kill chain ran IKE exploitation on port 500 to force callbacks on port 2007, dropped a renamed Chisel binary (fos) for reverse SOCKS pivoting, and deployed Sliver C2 from servers at 31.57.147.229, 31.57.38.155, 23.27.140.108, and 23.27.143.170, with victim-named Qilin binaries (kruss, qusar, tron, sssd) capable of encrypting Linux, ESXi, and Nutanix AHV hosts via ChaCha20. Defenders should hunt for Sliver/Chisel processes on edge appliances, monitor /etc/wg config.xml access on WatchGuard, block the listed C2 IPs, patch the seven CVEs immediately, and treat firewalls/VPNs as high-priority telemetry gaps since these appliances rarely run AV/EDR stacks.
Read the full story