Know what changed.
Trace why it matters.

Qilin has operated since September 2022 and is described as the most active ransomware-as-a-service group, with at least 365 organizations claimed as victims over the preceding three months. Qilin recruits affiliates by offering them at least 80% of extortion proceeds and uses double extortion: stealing sensitive data, encrypting systems, and threatening to publish the stolen files.

The reported identity trail describes an evolution from fraud and online arbitrage in 2018–2019 to organizing more complex cybercrime activity, including malware, botnets, and payment infrastructure, in 2020–2023.

ESET reported a previously undocumented toolset called Cereal on government Microsoft Exchange servers in Kazakhstan and Romania, attributing it with high confidence to the Russia-linked Turla APT group. Cereal’s modular .NET components largely arrive encrypted, unpack in memory, and leave few files on disk; only the initial loader is saved as a regular .NET file.

The CerealNeuron backdoor uses the victim’s internet-facing Exchange server as its operator-accessible control point, receiving commands through web paths resembling Outlook Web Access, Autodiscover, and ActiveSync traffic rather than contacting an attacker-controlled server.

Remus Stealer is marketed as a $1,000-per-month Enterprise feature that allegedly provides persistent access to compromised Gmail inboxes, including after password changes, browser closure and session revocation; its effectiveness remains unverified. Hudson Rock reports that the feature can provide a searchable mailbox within a stolen-device dashboard and allow an already acquired mailbox to be shared with other operators.

If the persistence claims are true, attackers could read password-reset links and verification codes in Gmail and use them to access other accounts linked to the mailbox.