Full Report
Wir haben Hinweise darauf, dass die Ransomware-Gruppe Qilin Initial Access von Akteur:innen der ZipLine-Phishing-Kampagne erwirbt und für eigene Verschlüsselungs- und Erpressungsoperationen weiterverwendet. In Österreich liegen uns bereits bestätigte Fälle vor. Aus der Schweiz wurde uns ein Vorfall gemeldet, bei dem die ZipLine-Kette ebenfalls als Root Cause identifiziert wurde. Die ZipLine-Kampagne wurde Ende 2025 von Check Point Research erstmals umfassend beschrieben und richtet sich gezielt gegen kritische Fertigung und exportorientierte Mittelständler. Die Angreifer:innen treten als Recruiter oder Personalvermittler:innen auf, initiieren über das öffentliche Kontaktformular der Zielunternehmen einen längeren, scheinbar legitimen Schriftverkehr und bringen die Opfer erst nach Tagen oder Wochen dazu, eine präparierte ZIP-Datei zu öffnen.
Analysis Summary
# Incident Report: Qilin Ransomware Exploiting ZipLine Phishing Access
## Executive Summary
The Qilin ransomware group is actively acquiring initial access from the "ZipLine" phishing campaign to conduct encryption and extortion operations. The attackers use highly targeted social engineering, posing as recruiters to build trust over several weeks before delivering malware via ZIP files. Multiple confirmed cases have been reported in Austria and Switzerland, primarily targeting critical manufacturing and export-oriented SMEs.
## Incident Details
- **Discovery Date:** Late 2025 (Initial ZipLine discovery); May 26, 2026 (Qilin association update)
- **Incident Date:** Ongoing (verified activity in May 2026)
- **Affected Organization:** Multiple undisclosed mid-sized enterprises (Mittelstand)
- **Sector:** Critical Manufacturing, Export-oriented SMEs
- **Geography:** DACH region (Germany, Austria, Switzerland)
## Timeline of Events
### Initial Access
- **Date/Time:** Weeks/Days prior to compromise (Long-term engagement)
- **Vector:** Targeted Social Engineering / Phishing (Recruitment-themed)
- **Details:** Attackers use public contact forms to initiate contact. They maintain a seemingly legitimate correspondence for days or weeks to bypass suspicion.
### Lateral Movement
- **Details:** (Not specified in text, but characteristic of Qilin operations following manual initial access handover).
### Data Exfiltration/Impact
- **Details:** Integration of the ZipLine access chain into Qilin's ransomware-as-a-service (RaaS) platform for data theft and system encryption.
### Detection & Response
- **How it was discovered:** Forensic analysis of victims in Austria and Switzerland identifying ZipLine as the "Root Cause."
- **Response actions taken:** Retrospective log analysis (90 days), domain blocking, and proactive monitoring of newly registered TLS certificates.
## Attack Methodology
- **Initial Access:** Social engineering via public contact forms and email (Recruiter persona).
- **Persistence:** Maintaining long-term dialogue prior to payload delivery.
- **Defense Evasion:** Use of legitimate-looking DACH-specific domains (.at TLD) and dedicated Microsoft 365 MX infrastructure; low-volume, "slow" interaction to avoid automated spam filters.
- **Lateral Movement:** Access sold by ZipLine brokers to Qilin operators.
- **Impact:** Deployment of ransomware for encryption and double extortion.
## Impact Assessment
- **Financial:** High (Ransom demands and business interruption).
- **Data Breach:** Confirmed exfiltration and extortion (Standard Qilin TTPs).
- **Operational:** Disruption of critical manufacturing processes.
- **Reputational:** High risk for export-oriented businesses.
## Indicators of Compromise
### Network Indicators
- jn-recruitment[.]at
- headmatch[.]at
- alpentalent[.]at
- steinersearch[.]at
- valenzsearch[.]at
- haasrecruiting[.]at
- bergersearch[.]at
### Infrastructure Patterns
- MX Hosts: `[domain]-at.mail.protection.outlook[.]com`
- MX Hosts: `[domain]-com.mail.protection.outlook[.]com`
### Behavioral Indicators
- Unusual recruitment inquiries via web contact forms.
- Protracted email conversations without technical attachments, followed by a sudden delivery of a ZIP file after trust is established.
## Response Actions
- **Containment:** Blocked known recruiting-themed domains at the email gateway.
- **Eradication:** Investigation of all systems where ZIP files from these senders were opened.
- **Recovery:** Restoration from backups in confirmed Qilin cases (where applicable).
## Lessons Learned
- **Social Engineering Sophistication:** Traditional "quick" phishing has evolved into long-term "luring" campaigns that bypass standard user awareness training.
- **Supply Chain of Access:** Initial Access Brokers (ZipLine) are efficiently handing off "vetted" corporate access to sophisticated ransomware groups (Qilin).
## Recommendations
- **Retrospective Analysis:** Audit email logs for the last 90 days for any interaction with the identified domains.
- **User Training:** Specifically brief HR and Sales departments (who use public contact forms) on "Delayed Payload" phishing.
- **Policy:** Implement "Show File Extensions" and restrict the execution of scripts or binaries originating from ZIP archives.
- **Email Security:** Flag or sandbox emails from newly registered domains or domains with specific recruiter-themed keywords that use M365 protection but were only recently established.