Looking Through a Pinhole at a Qilin Ransomware Attack

Huntress investigated a Qilin ransomware incident where a rogue ScreenConnect RMM was installed and used to transfer r.ps1, s.exe (likely an infostealer) and ss.exe; the actor disabled Microsoft Defender and ransom notes were created, with analysts piecing together activity from managed AV alerts, Windows Event Logs, PCA and AmCache artifacts and publishing IoCs (file hashes and a ScreenConnect instance ID) to guide response.