qilin Ransomware Claims New Victim: Thrifty Building Supply | Retail & E-Commerce...

Executive Summary

The Qilin ransomware group publicly claimed compromise of Thrifty Building Supply, a U.S. retailer in the building‑supply e‑commerce segment. The leak site publishes the stolen data, indicating exposure of customer and financial records. Decision required now: activate incident response, assess breach scope, and determine regulatory disclosure obligations.

Verified Facts

• Ransomware group identified as Qilin — source.
• Victim identified as Thrifty Building Supply — source.
• Sector classified as Retail & E‑Commerce, located in the United States — source.
• Public leak site URL: https://www.ransomware.live/id/VGhyaWZ0eSBCdWlsZGluZyBTdXBwbHlAcWlsaW4/ — source.

Threat Classification

Threat type: Ransomware (HIGH CONFIDENCE). Affected sector: Retail & E‑Commerce (HIGH CONFIDENCE). Geographic scope: United States (HIGH CONFIDENCE). Exploitation status: Active, with data already exfiltrated and published (HIGH CONFIDENCE). Attacker motivation: Financial extortion and data‑leak pressure (HIGH CONFIDENCE).

Threat Severity Assessment

Severity: CRITICAL

• Exploitability – ransomware is known to execute without user interaction once delivered (HIGH CONFIDENCE).
• Scope of impact – compromise of a retail supply chain can affect thousands of customers and business operations (MEDIUM CONFIDENCE).
• Prevalence – Qilin has demonstrated multiple public claims in the past, indicating a capable and repeatable operator (MEDIUM CONFIDENCE).

Business Impact

• Operational disruption: encryption of critical inventory and order‑processing files could halt sales and fulfillment for days.
• Regulatory liability: U.S. state data‑breach laws (e.g., California CCPA) may require notification within 30 days, with penalties up to $7,500 per resident; potential exposure under NIST‑aligned frameworks (e.g., NIST CSF) for inadequate protection.
• Financial exposure: ransom demand (not disclosed) plus incident response, forensic, and remediation costs likely in the six‑figure range for a mid‑size retailer.
• Reputational damage: public leak of customer data can erode brand trust and drive churn, especially in B2B supply‑chain relationships.

Technical Analysis

The article provides only the claim of compromise and the leak site URL; no specific attack vector, exploit chain, affected software versions, or vulnerability identifiers are disclosed.

MITRE ATT&CK Mapping

IOC Intelligence

• Domain – ransomware.live (observed in leak URL) – Type: Domain.

No additional public IOCs confirmed at time of publication. Defenders should build hunt rules around the following behavioral indicators typical of Qilin ransomware:

• Creation of ransom note files (e.g., READ_ME.txt) in user directories.
• Encryption of files with a unique extension (e.g., .qilin, .locked).
• Execution of PowerShell commands that download or decode payloads from external URLs.
• Persistence via scheduled tasks or registry Run keys that launch the ransomware binary.

Detection Engineering Guidance

• Network: Monitor DNS queries and HTTP/HTTPS requests for the domain ransomware.live on all outbound proxies and DNS resolvers.
• Endpoint: Alert on creation of files named READ_ME.txt or similar ransom notes in user profile folders.
• Endpoint: Detect processes that spawn PowerShell with the -EncodedCommand flag and a base64 payload.
• Endpoint: Flag new scheduled tasks whose action points to unknown executable paths in %TEMP% or %APPDATA%.
• Endpoint: Watch for mass file‑renaming events where the new filename ends with a non‑standard extension (e.g., .locked, .qilin).

Sigma Rules

title: Network Communication to Known Qilin Leak Domain
id: 3f9c2a1e-5b7d-4a6f-9c1e-2d8f6b7a9c0d
status: stable
description: Detect DNS or HTTP requests to the ransomware.live domain used by Qilin to publish stolen data.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: dns
detection:
    selection_dns:
        QueryName|contains: 'ransomware.live'
    selection_http:
        DestinationDomain|contains: 'ransomware.live'
    condition: selection_dns or selection_http
falsepositives:
    - Legitimate security research or threat‑intel activities
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001

Threat Hunting Queries

• Hypothesis: Hosts querying ransomware.live – Data source: DNS server logs (QueryName field).
• Hypothesis: HTTP GET/POST to ransomware.live – Data source: Proxy or firewall logs (Host, URI fields).
• Hypothesis: Creation of files with extension .locked or .qilin – Data source: Sysmon Event ID 11 (FileCreate).
• Hypothesis: PowerShell processes with -EncodedCommand – Data source: Sysmon Event ID 1 (ProcessCreate) and command line field.
• Hypothesis: New scheduled task pointing to an executable in %TEMP% – Data source: Windows Security Event ID 4698 (ScheduledTaskCreated).

SOC Analyst Playbook

• P0 (0‑

🔗 Related Intelligence Reports

• Same threat actor: qilin Ransomware Claims New Victim: Integraduanas
• Related topic: incransom Ransomware Claims New Victim: UNIPLASTICS.COM | Manufacturing Sector
• Related topic: incransom Ransomware Claims New Victim: BANGKOKCABLE | Manufacturing Sector
• Related topic: insomnia Ransomware Claims New Victim: ***********
• Related topic: xpl0itrs Ransomware Claims New Victim: Mihuru