Newcomer Qiulong Ransomware Gang Hits a New Target
The Qiulong gang announced another victim today, the Brazilian Hominem Clinic. Qiulong is a newcomer in the ransomware sphere, only days old. Despite that, the novel ransomware group is already making waves.
- Qiulong appears to be isolated to Brazil for now, but it’s unclear if this is by choice or that’s the extent of the gang’s reach
- Despite its recent inception, this is already a controversial organization, as Qiulong is the name of an ancient Chinese dragon
- This is most likely by design, as many cybercriminal gangs choose deceiving and confusing names, often unrelated to their origin
- It is unclear if Qiulong is a legitimate ransomware organization or merely an empty name used by another legitimate actor
The latter is common in the ransomware sphere. The FBI often targets ransomware organizations, along with counterparts from other continents. If successful, the FBI’s operations will destroy the gang entirely, exposing its members and structure.
To prevent that, many gangs prefer to rebrand themselves regularly, rely on affiliates more, or simply create puppet groups like Qiulong. These will often send law enforcement agencies on ghost hunting, making them spend time and resources for nothing.
It’s unknown whether that’s the actual case with Qiulong or if this is just some unwarranted theory.
Despite it being entirely new in the ransomware sphere, Qiulong appears to be not only highly active, but quite resourceful as well. The hackers are very quick at detecting new targets, scan their vulnerabilities, and breach them seemingly all in one day.
This lends credence to the theory that Qiulong may be more than meets the eye. That being said, it’s not out of the ordinary for an entirely new group to appear dominant and aggressive. They’re trying to build their name and make an impact from the get-go.
Our Mission
We believe security online security matters and its our mission to make it a safer place.
What to Expect from Quilong?
The future is uncertain, but Quilong’s effectiveness does create a scary prospect. The gang has been extremely active since its inception, often targeting multiple victims at once. For now, it appears that the hackers prioritize the health industry.
Qiulong operators have breached several prominent Brazilian plastic surgeons over the past several days. The hackers have mocked and denigrated the victims in the subsequent posts, stating that the doctors don’t care about their patients’ privacies.
In most cases, Qiulong has leaked part of the stolen data, which included confidential client data and even nude photos of some patients. It’s also important to note that Qiulong hackers appear to care about their image a lot.
This transpires mostly from the ransom notes that they leave behind, which are often in perfect English. This isn’t unheard of in the ransomware space, but it doesn’t happen very often either. Most ransomware notes are written in poor English and riddled with grammar mistakes.
Based on the group’s recent development and level of activity, it’s safe to say that Qiulong appears to be a legitimate cyberthreat. If you believe you qualify as a potential victim, you may need to act today.
Qiulong is known to prioritize private corporations.