Latest / Tech Talks With Kinsoft / Qilin's WA Spree – Esperance Metaland

Transcript

Qilin's WA Spree – Esperance Metaland · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. Welcome to
0:02
Tech Talks with Kinsoft. You know, it's funny,
0:04
we both just jumped right on that exact intro.
0:07
Yeah, well, we're definitely eager to get into
0:09
today's topic. We really are. Because, you know,
0:12
usually when you picture a business falling victim
0:14
to a cyber attack, you imagine this massive,
0:18
sudden... Digital explosion. Right. Like alarms
0:21
ringing in an IT control room. Exactly. Screens
0:23
flashing red and the entire company network just
0:26
locks down in an instant. Brutal chaos. Total
0:29
chaos. But right now we're looking at this sudden
0:32
wave of cyber extortion that's sweeping through
0:34
regional Australian businesses in early 2026.
0:38
And the reality is it feels. completely different
0:42
it's much quieter yeah imagine waking up you
0:44
walk into your kitchen and you find a typed menacing
0:47
ransom note just sitting right there on your
0:49
table oh wow yeah that's a terrifying image right
0:53
and the note claims your house has been entirely
0:55
cleared out of all your valuables it's really
0:57
visceral terrifying feeling oh absolutely it
1:00
creates this immediate sense of panic your first
1:03
instinct is just that your entire life has been
1:05
turned upside down but then you start looking
1:08
around your house and uh Your television is still
1:12
matted on the wall. Right. Your jewelry box on
1:14
the dresser, it hasn't been touched. Your laptop
1:17
is sitting exactly where you left it. So nothing's
1:19
actually missing. Exactly. You're holding this
1:21
terrifying note demanding money, but you can't
1:24
actually figure out if a single thing was stolen.
1:26
And that bizarre unsettling gap between a massive
1:30
threat and the reality on the ground. That's
1:33
the core of our conversation today for you listeners.
1:36
It really is, because we are looking closely
1:38
at a string of ransomware attacks targeting Western
1:40
Australia and Queensland. And this is driven
1:43
by a group called Quillen. Right. Yes. Queensland.
1:45
And what stands out immediately is the distinct
1:48
regional focus. I mean, we aren't talking about
1:50
multinational banks headquartered in Sydney or
1:53
Melbourne here. Right. It's a concentrated cluster
1:55
in regional areas. Exactly. Out of four victims
1:57
claimed in just under a month, starting in late
2:00
January 2026, three of them were in Western Australia.
2:04
Yeah. You had Esperance Communications at the
2:07
end of January, Mount Barker Cooperative in early
2:10
February, and then a victim over in Queensland.
2:13
But the incident that perfectly captures this
2:16
whole, I guess I call it a phantom ransom note
2:19
vibe, is what happened to Esperance Meadowland.
2:22
Oh, absolutely. Esperance Meadowland is the perfect
2:24
example. So on the 21st of February, 2026, this
2:28
regional WA business suddenly found its name
2:31
plastered across Quillen's dark web leak site.
2:34
And they didn't just casually mention them, did
2:35
they? No, not at all. The group strutted around
2:38
making very specific, very quantifiable claims.
2:42
They stated they had successfully exfiltrated
2:44
14 gigabytes of sensitive data. Wow. Yeah, comprising
2:48
over 16 ,000 individual files. Okay, I want to
2:51
pause on that word for a second, exfiltrated.
2:54
Because it sounds like a spy movie term. It does
2:56
sound very dramatic. But in plain English, we're
2:58
basically talking about the act of smuggling
3:00
data out of the building. Like the hackers are
3:01
claiming they didn't just lock the files up.
3:03
Right. They made copies. They made copies and
3:05
hauled those copies out the back door to their
3:07
own servers. And, you know, 14 gigabytes of purely
3:11
sensitive company data is massive. It's a huge
3:15
amount of text. Yeah, we aren't talking about
3:17
a few heavy video files here. We're talking about
3:19
text documents, spreadsheets, tax records, customer
3:22
details. That is the digital equivalent of a
3:26
massive, heavy, physical filing cabinet, absolutely
3:30
stuffed to the brim with paper. That's a great
3:33
way to picture it. So if they really managed
3:35
to haul this giant cabinet out of Esperance Meadowlands
3:39
Network, where's the proof? Like, have they shown
3:42
any of it? See, that is the most critical detail
3:45
of this entire incident. The answer is no. Quillen
3:48
provided absolutely zero hard evidence to verify
3:51
that the breach actually contained what they
3:53
claimed. Wait, really? Nothing at all? Nothing.
3:56
There were no sample files leaked. There were
3:58
no screenshots of sensitive directories. It was
4:00
literally just a text post on a hidden forum
4:02
demanding a ransom. So they're out there bragging
4:05
about the heist of the century, but they aren't
4:07
holding up any of the cash. Exactly. Which puts
4:10
the victim in an incredibly complex situation.
4:13
You have to understand the genuine uncertainty
4:14
this creates for, say, an incident response team
4:18
or a regional business owner sitting in their
4:21
office in Esperance. Yeah. I mean, you see this
4:23
post and you're forced to figure out if your
4:26
most sensitive intellectual property and employee
4:28
records are actually in the hands of criminals.
4:31
Right. Or if the hackers just scraped some public
4:33
information off your company website and packaged
4:35
it up to look terrifying. When there is no proof,
4:38
you're essentially shadowboxing. Shadowboxing.
4:41
That's a good way to put it. What's wild is that
4:43
this lack of proof at Esperance Meadowland, it
4:46
isn't just a one -off mistake by the hackers.
4:48
No, not at all. It seems to be part of a really
4:51
bizarre operational pattern for Kylan right now.
4:53
Yeah. The Mount Barker cooperative case is particularly
4:56
illustrative of this pattern. So on February
4:59
11th, an affiliate of the Kylan group listed
5:01
them on the leak site. Okay. And in that instance,
5:04
they actually claimed to have published the stolen
5:06
data. They literally said, here is 40 gigabytes
5:09
of your data. Go look at it. Oh, so they'd supposedly
5:12
provided the proof that time. Well, they provided
5:14
a link. But when security researchers and journalists
5:17
went to click that dark web link to view or download
5:21
the data, it just returned a standard web error.
5:24
Let me guess. A 404. Not found. A 404 error on
5:29
a dark web extortion site. I mean, that is almost
5:32
comical. It really is. And then there's the unnamed
5:34
Queensland victim from February 22nd. The dark
5:37
web listing for them doesn't even have a file
5:40
count or a date. Yeah. It's just a blank threat.
5:43
Which brings us to the psychological warfare
5:45
aspect of modern cyber extortion. Okay. Unpack
5:48
that for us. Well, we tend to view ransomware
5:51
groups purely as technical threats, right? We
5:53
imagine brilliant coders furiously typing in
5:56
dark rooms. Hackers in hoodies. Exactly. But
5:59
at their core, they are extortionists. And extortion
6:02
relies entirely on fear and perceived leverage.
6:06
They want you to panic. But wait, I have to ask
6:08
this from the perspective of a business owner.
6:10
If I see my company name on that site and I click
6:13
the link and get a 404 error, my first instinct
6:16
is going to be relief. Oh, absolutely. I'm going
6:18
to assume they're bluffing or their site is broken
6:20
and maybe I can just ignore it. Can I safely
6:22
make that assumption? You absolutely cannot assume
6:25
a 404 error means the data doesn't exist. Really?
6:28
Why not? Because dark web infrastructure, specifically
6:31
the Tor network that these leak sites run on.
6:34
is notoriously unstable. It might just be misconfigured
6:38
server settings on their end, or, and this is
6:41
important, they might be holding the data back
6:44
intentionally to slowly build pressure. Like
6:47
a drip feed of anxiety. Exactly. A drip feed
6:49
to see if you'll crack and pay up before they
6:52
even have to prove anything. Wow. Okay, so how
6:55
do you avoid completely panicking while still
6:58
taking the threat seriously? Because if the dark
7:01
web site is useless for figuring out the truth,
7:03
where do you look? You don't react to the external
7:06
dark web posts. You react to your own internal
7:08
data logs. Internal logs. Yes. This requires
7:11
a calm, systematic assessment. You look at your
7:14
network traffic from the dates in question. Do
7:16
your firewalls show a massive 40 gigabyte outbound
7:19
transfer to an unknown server? Because 40 gigs
7:22
is hard to hide. Very hard. Do you see unauthorized
7:25
access to your file servers? If your internal
7:28
logs show absolutely no massive data exfiltration
7:31
and the hackers are just throwing up 404 errors,
7:35
your risk assessment fundamentally changes. So
7:38
you navigate that gray area with internal evidence,
7:41
not external fear. Exactly right. OK, so that
7:44
explains the psychology of the victim. But I'm
7:46
still stuck on the sloppiness of the attackers.
7:48
Yeah, it's interesting. Like, why are we seeing
7:51
broken links, missing file counts and empty threats?
7:54
If these are supposed to be elite hackers, why
7:56
do they seem so disorganized? To understand that,
7:59
we need to look under the hood at the business
8:01
model powering Qualen. They operate on a model
8:04
known as ransomware as a service or RAS. Ransomware
8:07
as a service. So it's like a fast food franchise
8:09
model, but for cybercrime. That is a perfect
8:12
analogy. The core Quillen developers, the corporate
8:15
headquarters in this scenario, aren't necessarily
8:17
the ones breaking into Esperance Metal Land.
8:20
Right. Quillen Corporate develops the branding.
8:22
They maintain the dark web leak site. And they
8:25
write the highly sophisticated ransomware software
8:27
itself. And then they rent that software out
8:30
to local franchisees, which I think the industry
8:33
calls affiliates. Yes, affiliates. And these
8:36
affiliates are the ones actually doing the dirty
8:37
work of breaking into the regional businesses
8:40
network. and deploying the software that's right
8:43
And if they manage to extort money from the victim,
8:46
they split the profits with the Quillen headquarters.
8:48
That is wild. And this franchise model is terrifyingly
8:52
scalable because it lowers the barrier to entry
8:55
so much. We have data from a November 2025 Threat
8:59
Locker report showing just how fast this specific
9:02
engine is moving. What did the report say? Well,
9:05
in 2022, Quillen claimed just 45 victims. 2025,
9:10
they were boasting more than 800 victims globally.
9:12
Over 800 victims. That is an exponential explosion.
9:15
Yeah. But, you know, going back to the fast food
9:17
analogy, when you have a franchise scaling that
9:19
quickly, your quality control is going to completely
9:22
fall apart. Precisely. Corporate HQ might have
9:24
a brilliant recipe for the malware, but the local
9:27
franchisee might just be an amateur who is incredibly
9:30
sloppy at their job. Which is an active debate
9:32
in the cybersecurity community right now regarding
9:34
Coil and sophistication. Because of the franchise
9:37
model, the skill level of the attacker varies
9:40
wildly depending on which affiliate targets you.
9:42
Makes sense. Some analysts suspect that certain
9:45
Quail affiliates aren't executing complex, elite
9:48
hacks at all. Instead, they are just using automated
9:51
scanning tools to hunt for company databases
9:54
that were accidentally left open to the public
9:56
internet. Oh, wow. So they aren't picking locks.
9:59
No. They were just walking down the street checking
10:01
for unlocked front doors. Exactly. They find
10:04
an open database, download the contents, and
10:06
demand a ransom. Which would absolutely explain
10:09
the missing files and the broken dark web links.
10:11
Yeah. If the affiliate is just an amateur who
10:14
bought access to Qualent's platform, they might
10:16
mess up the data upload or misconfigure the hidden
10:19
server. Or just straight up lie about how much
10:22
data they grabbed to try and secure a quick payday.
10:24
Right. However, we cannot underestimate the core...
10:27
technology. While the individual affiliate might
10:30
be a sloppy amateur, the Kwilan headquarters
10:33
provides them with a genuinely potent weapon.
10:36
So the malware itself is still highly dangerous.
10:39
Extremely. The evidence shows that the Kwilin
10:42
ransomware software utilizes highly effective
10:44
methods to embed itself in a network. And there
10:48
is one metric from the ThreatLocker report regarding
10:50
Kwilin that every single business leader needs
10:53
to commit to memory. Okay, what is it? 19 days.
10:57
19 days. What happens for 19 days? That is their
11:00
historical average dwell time. Dwell time? Yeah.
11:04
It means the affiliate... it breaks into the
11:06
network, establishes a hidden communication channel
11:08
with their own servers, and then just lurks inside
11:11
the victim's network completely undetected for
11:14
almost three weeks before they actually trigger
11:16
the ransomware and lock everything down. Almost
11:18
three weeks. I mean, so they aren't just doing
11:20
a smash and grab. What are they doing inside
11:23
the network for all that time? They are performing
11:25
what we call lateral movement and privilege escalation.
11:29
OK, pretend I have no idea what those terms mean.
11:31
How does that work, like, mechanically? Well,
11:34
think of it like a physical break -in. The attacker
11:35
doesn't start in the vault. Okay. They start
11:37
by breaking a window in the lobby. Maybe by compromising
11:40
a receptionist's computer. From there, they move
11:43
laterally looking for the janitor's keys. Once
11:46
they have those, they access the elevator. Then
11:49
they try to escalate their privileges to get
11:51
the CEO's master key. Ah, I see. In a digital
11:55
sense, they are moving from a low -level workstation
11:57
to the central servers, seeking administrative
12:00
passwords. They use those 19 days to map the
12:03
network, locate the most sensitive data at Exfiltrate.
12:07
Read the company's financial statements to figure
12:10
out how much ransom they can afford to pay. That's
12:13
creepy. And crucially, they hunt down the company's
12:15
backups to destroy them. That is horrifying.
12:18
It's literally like a horror movie where the
12:20
call is coming from inside the house and they've
12:22
been living in your attic for weeks. It really
12:24
is. But wait, if they are stumbling around in
12:27
the dark. digital hallways of a business for
12:30
19 days? Yeah. Isn't that actually a massive
12:32
vulnerability for them? How do you mean? Well,
12:35
doesn't that long dwell time mean we have a three
12:37
week head start to catch them before they steal
12:39
the data or lock the screens? You've hit on the
12:42
exact paradigm shift that modern network defense
12:44
requires. A 19 -day dwell time is an attacker's
12:49
greatest vulnerability. Yeah. The hackers are
12:51
entirely reliant on remaining undetected while
12:55
they stage their attack. If you catch them on
12:57
day three or day 12, there is no ransomware deployment.
13:01
There is no dark web extortion post. It is a
13:03
19 -day window of opportunity for the defender.
13:07
So let's talk about how to actually use that
13:09
window. We know they're targeting regional businesses
13:11
in WA and Queensland. We know they're using this
13:13
franchise model looking for easy wins. Let's
13:16
use the Esperance Meadowlands situation as a
13:18
lens here. Okay. How do regional businesses turn
13:22
the tables? What are the practical mechanical
13:24
defenses that break this attack chain? Step one
13:27
is shutting down the initial access point. And
13:30
that almost universally means implementing multi
13:32
-factor authentication or MFA everywhere. Yeah,
13:35
we hear about MFA constantly, you know, getting
13:37
a text code or using an app on your phone. But
13:40
how does that specifically stop a Quillen affiliate?
13:42
You mentioned the unlocked front door earlier.
13:45
Imagine an amateur affiliate goes onto an underground
13:48
forum and buys a stolen password belonging to
13:51
one of your employees. Right. If you don't have
13:53
MFA, that stolen password is the master key to
13:56
your front door. The attacker logs in and the
13:59
19 -day clock starts. Right. But if MFA is active,
14:02
the attacker enters the password and the system
14:05
prompts them for a fingerprint or a code sent
14:07
to the employee's phone. And the attacker doesn't
14:09
have the phone. Exactly. The attack chain breaks
14:12
right there. MFA neutralizes the value of stolen
14:15
passwords, keeping the lazy franchisees out.
14:18
Okay, so the deadbolt is installed. But what
14:21
if a more skilled affiliate slips past the MFA?
14:23
Maybe they find a flaw in the software itself.
14:26
What is step two to cache them during those 19
14:29
days? Step two is active monitoring. You need
14:33
visibility into your network to catch them while
14:35
they are lurking. Remember, when they are moving
14:37
laterally and escalating privileges, they are
14:40
doing things normal employees don't do. So how
14:43
do you spot that? You use tools like Endpoint
14:45
Detection and Response or EDR. EDR platforms
14:49
don't just scan for known bad viruses. They look
14:52
for abnormal behavior. Like what? For example,
14:55
if an accountant's computer, which normally just
14:57
opens spreadsheets, suddenly attempts to access
15:00
the central HR server at 3 .0 AM and run a complex
15:04
administrative command to copy 16 ,000 files,
15:07
the EDR system flags it instantly. Oh, wow. It's
15:11
essentially installing highly sensitive motion
15:14
sensors in the digital hallways of your business.
15:16
That's a perfect way to put it. If someone is
15:18
walking where they shouldn't be in the middle
15:20
of the night, the alarms go off. Exactly. Now,
15:22
step three is your ultimate fail -safe, backups.
15:25
But not just any backups. Immutable backups.
15:29
Immutable, that's a term that gets thrown around
15:30
a lot in tech circles. Yeah. What does that actually
15:33
mean mechanically in the context of a ransomware
15:35
attack? Immutable means read -only and unchangeable.
15:38
Let's say your monitoring fails, the attacker
15:40
goes unnoticed for the full 19 days, and they
15:43
finally trigger the Quillen ransomware to lock
15:45
all your files. Worst case scenario. Right. The
15:48
attacker then tries to encrypt or delete your
15:51
backups, so you are forced to pay them. An immutable
15:55
backup acts like a physical drop vault. Your
15:58
system can put data into the vault, but neither
16:00
an employee, an administrator, nor a hacker can
16:04
alter or delete the data inside it until a set
16:06
amount of time has passed. Oh, I see. The ransomware
16:09
tries to encrypt the backup, and the vault simply
16:12
rejects the command. That is brilliant. It completely
16:15
removes the attacker's leverage. You don't have
16:17
to negotiate or pay to decrypt your systems.
16:20
You just wipe the infected computers and restore
16:23
everything from yesterday's unchangeable backup.
16:25
You ensure the business can continue to operate.
16:27
Which brings us to the final piece of the defense
16:29
puzzle. Incident response, or IR. Having an IR
16:34
plan seems like it addresses the psychological
16:36
side of this whole ordeal we talked about earlier.
16:39
It does. Having a comprehensive incident response
16:41
plan is what prevents the absolute panic we discussed
16:44
at the very beginning of the show. An IR plan
16:46
dictates exactly who to call, how to isolate
16:49
infected machines to stop the spread, and crucially,
16:53
how to calmly verify the dark web claims using
16:56
internal logs rather than paying ransoms out
16:58
of pure terror. It is the difference between
17:01
a controlled business interruption and an existential
17:04
corporate crisis. It's the difference between
17:06
seeing that terrifying ransom note on your kitchen
17:08
table and screaming versus calmly pulling up
17:11
your security camera footage to verify if anyone
17:14
actually came inside. Exactly. And Esperance
17:16
Meadowlands' situation is a masterclass in why
17:19
this level of preparation matters. When a regional
17:22
business is targeted, the geographical distance
17:24
from major tech hubs like Sydney doesn't afford
17:27
them a lower standard of security. No, definitely
17:29
not. The threat actors certainly aren't discriminating
17:32
by postcode. They're discriminating by vulnerability.
17:35
They really aren't. And that's what makes this
17:37
2026 spree so eye -opening. For you listening
17:40
at home, we've traced the path of these targeted
17:43
attacks hitting regional WA in Queensland. Yeah.
17:46
Zeroing in on those massive yet unverified claims
17:49
of stolen data. We looked under the hood at the
17:52
messy reality of the ransomware as a service
17:54
model. where highly potent malware is wielded
17:57
by affiliates with varying levels of competence,
17:59
resulting in bizarre 404 errors and phantom data.
18:04
It's a strange landscape. It is. And most importantly,
18:07
we mapped out how to use that 19 -day dwell time
18:10
to your advantage, locking the doors with MFA,
18:13
installing motion sensors with EDR, maintaining
18:16
immutable backups, and keeping a cool head with
18:19
an incident response plan. Which leaves us with
18:21
a final provocative thought to consider. Oh,
18:24
lay it on us. We've talked extensively about
18:26
the psychological impact of unverified claims
18:28
and broken dark web links. As these ransomware
18:32
groups continue to scale, boasting hundreds or
18:34
even thousands of victims a year, what if the
18:36
future of cybercrime isn't about actually stealing
18:39
data at all? Wait, what do you mean? Think about
18:41
the effort it takes to maintain that 19 -day
18:43
dwell time without getting caught. If hackers
18:45
know they can cause immense operational panic,
18:48
trigger massive reputational damage, and extort
18:50
millions of dollars simply by generating a fake
18:53
dark web post and a 404 error, will they even
18:56
bother writing real complex ransomware code in
18:59
the future? If the illusion of a breach pays
19:01
just as well as the technical execution of one,
19:04
the entire landscape of cyber threats could shift
19:06
away from software exploitation entirely and
19:09
move toward pure psychological manipulation,
19:12
extortion without the malware. That is a wild
19:15
concept. Yeah. So the next time you find a terrifying
19:18
ransom note on your kitchen table, the real test
19:20
isn't just figuring out if anything was stolen.
19:23
The real test is having the systems and monitoring
19:25
in place so you never have to guess in the first
19:27
place. To make sure your business doesn't end
19:29
up as a target on a dark web leak site, visit
19:31
www .kinsoft .com .au today to discuss your security
19:35
and IT needs.