Qilin ransomware has evolved significantly since its first appearance. SOC Prime’s November 2026 analysis compared a March baseline variant with an October version that introduced fully automated execution, Active Directory reconnaissance, lateral movement through PsExec, dedicated VMware ESXi disruption modules, and a particularly clever defense evasion technique: rebooting the target system into Safe Mode to disable EDR sensors before beginning encryption.
That Safe Mode trick is getting attention in the security community. It’s smart — most endpoint detection tools don’t load their drivers in Safe Mode, so the ransomware operates in a sensor-free environment. But here’s what everyone is missing: that technique only matters if the ransomware payload successfully lands on the system in the first place.
The Upstream Problem Nobody’s Talking About
Qilin arrives on a target system the same way most ransomware does: phishing email with a malicious attachment, exploit kit delivering a dropper, or compromised credentials used to upload a payload via RDP. Regardless of delivery method, the Rust-compiled executable has to be written to the Windows file system before it can execute.
That write operation happens at the kernel level. It’s not optional. It’s not something the malware can bypass by being clever with its code. A file that doesn’t exist on disk cannot execute.
FileSure Defend operates at exactly that layer — the Windows kernel filter driver intercepts file operations before they complete. You define a rule: browser processes cannot write executable files. Email clients cannot write executable files to user-writable directories. Remote Desktop sessions from non-administrative accounts cannot write executables to system directories.
When Qilin’s payload attempts to land — whether it’s a .exe, .dll, or any other executable format — the write operation is intercepted and blocked. The file never touches the disk. The attack ends before it starts. No execution means no Active Directory reconnaissance, no PsExec lateral movement, no Safe Mode reboot, and no encryption.
Why Signature-Based Detection Fails Here
The article notes that Qilin is now written in Rust and includes eight distinct execution phases, cryptographic negotiation via CPUID, and integration with the Windows Restart Manager API. That level of sophistication is specifically designed to evade signature-based detection.
Traditional antivirus and EDR tools analyze file behavior, compare hashes against known malware databases, and use heuristics to identify suspicious patterns. Qilin’s authors know this — so they rewrite the code, change the compilation toolchain, obfuscate the execution flow, and release a variant that no signature recognizes.
Then they wait. Security researchers eventually analyze the new variant, create signatures, and push updates. That process takes hours or days. Qilin attacks during that window.
FileSure doesn’t care what the payload is written in, how it’s obfuscated, or whether it’s been seen before. The rule is simple: unauthorized programs cannot write executable files. Qilin is not an authorized program. The write is blocked.
A variant from this morning is stopped the same way as one from five years ago. No signature update required.
Blocking Lateral Movement at the File System Layer
The article describes Qilin’s use of PsExec for lateral movement across a network. PsExec works by copying an executable to the target machine’s ADMIN$ share, then remotely creating a service to run it. That file copy is a file write operation to a network share — and FileSure intercepts it.
A simple rule blocks remote executable writes:
- File name filter:
*.exe;*.dll;*.bat;*.cmd;*.ps1 - Program name filter:
REMOTE ACCESS(FileSure’s exact, case-sensitive identifier for remote SMB write operations) - Operations: Write, Create
- Drive type: Hard drives
- Install type: Servers
Local processes on the server operate without restriction. Remote machines — including compromised workstations controlled by Qilin — cannot write executable files to the server’s local drives through network shares. The lateral movement attempt is blocked at the file system layer on the target server.
Containing Encryption Before Catastrophic Damage
If a payload somehow bypasses initial prevention controls and begins encrypting files, FileSure’s threshold-based detection rule limits the damage. Ransomware encryption is a bulk operation — hundreds or thousands of files modified per minute. Normal user activity doesn’t look like that.
A threshold rule configured for ransomware detection might look like this:
- File name filter:
*(all files) - Operations: Write, Rename / Move (ransomware renames files after encrypting them)
- Drive type: Hard drives, Network drives, Removable drives
- Threshold: 20 matches within 60 minutes
- Result: Block
A user saving a Word document ten times in an hour is well below the threshold. Qilin modifying 500 files in three minutes crosses it immediately. Subsequent write and rename operations are blocked. Damage is contained to the files modified before the threshold fired — typically a small fraction of the total.
The Real Question
The security industry keeps recommending the same mitigations: patch faster, monitor for suspicious activity, segment your network, protect your backups, train your users. All of that is fine — but none of it prevents the scumbag from writing the payload to your file system in the first place.
How many layers of detection are you stacking on top of a file system that lets anything write anything?
FileSure Defend controls file operations at the kernel level. The ransomware payload never lands. The attack ends before it starts. No Safe Mode tricks, no EDR evasion, no problem.
Start your free 21-day trial at bystorm.com.
Source: Qilin Ransomware in 2026: Evolution and Tactics
Category: Ransomware
Tags: qilin ransomware, rust malware, psexec lateral movement, safe mode evasion, kernel filter driver, file system security, ransomware prevention, windows security
