Qilin and Fortinet Exploitation Keep Pressure on Chile as

Attack chain and TTPs

The Qilin attack chain described in the consolidated material follows a repeated structure. Initial access comes first. The sources do not show a single method, but rather a hybrid pattern built on phishing, stolen credentials, exposed remote services and exploitation of edge appliances. In the Fortinet case, Scrutex.ai, Paubox and Viakoo place CVE-2024-21762 and CVE-2024-55591 among the most relevant entry points. The first allows remote code execution through SSL VPN. The second enables authentication bypass. Together, they create a path for large-scale automation against FortiGate and FortiProxy firewalls that remain exposed or out of date.

After entry, the sources describe internal reconnaissance and lateral movement. LinkedIn’s June 9, 2026 analysis of Qilin mentions RDP, SMB and WMI as mechanisms used to move across networks. ProvenData adds anomalous VPN or RDP authentications, domain admin activity from non-administrative workstations, mass LSASS access correlated with lateral movement, bulk deletion of shadow copies and simultaneous service termination as high-value signals. The end goal is to reach higher-impact systems, especially VMware ESXi hypervisors, because encrypting the hypervisor can take down multiple workloads at once.

Extortion happens on two tracks. The technical track uses encryption across Windows, Linux and ESXi. The public pressure track relies on prior data theft, threats to publish or sell the data, contact through email and Tor chats, and a price increase after 72 hours, according to the Qilin material on LinkedIn. That double-extortion component explains why leak sites are central to the ecosystem. The damage is measured not only in downtime, but also in exposure risk and the secondary monetization of stolen information.

FortiBleed adds a second tactical layer. This is no longer just about exploiting a perimeter vulnerability, but about mass credential compromise followed by reuse. Bitsight describes legacy SHA-256 hashes and offline cracking with 45 GPUs. The Hacker News explains an automated two-stage approach: first testing known username and password combinations, then passively observing authentication traffic crossing the firewall to collect new credentials. Devel Group adds the use of FortiGateSniffer, a Go tool that abuses the diagnose sniffer packet command, and the creation of ghost administrative accounts with names that mimic legitimate Fortinet components.

The relationship between Qilin and Fortinet is also structural. Fortinet coverage, CISA, the Canadian Centre for Cyber Security and Arctic Wolf show the issue has grown beyond a single incident. Credentials are compromised, configurations are exposed, firewalls remain unpatched, and initial access ecosystems are bought and sold. That helps explain why different groups, including linked brands such as The Gentlemen and Securotrop, converge on the same attack surface.

Regional impact

Regional overview

The available material does not allow for one unified metric across Latin America, but it does show a broadly consistent pressure pattern. Chile is the most measured case, with 8.8 billion cyberattack attempts in 2025 and 58 incidents logged in just the first six months of 2026. Brazil appears as one of the regional centers for ransomware victims and for exposure to phishing and public-sector compromise campaigns. Paraguay and Bolivia appear in ransomware monitoring panels, though with less public detail on the names of affected organizations. Colombia and Peru have no additional verifiable facts in the material provided, which does not mean there is no risk, only that the corpus contains no consolidated evidence for those countries.

Argentina

There are no additional verifiable facts in the research for Argentina. The material does not provide victims, campaigns or confirmed attributions for the country within the corpus supplied.

Chile

Chile has the densest set of data and therefore serves as the best gauge of the phenomenon. SEK, according to G5 Noticias, recorded 58 incidents affecting or exposing Chilean organizations between January and June 2026. Of those, 18 were posts on ransomware leak sites and 40 were posts in dark web cybercrime forums. That split matters because it shows the problem is no longer limited to attempts or detections, but to actual public exposure of data and to extortion processes that end on leak sites. Leak-site posts also increased 50 percent versus the same period in 2025.

Qilin was the most visible actor in that subset. G5 Noticias assigns it 11 of the 18 ransomware leak-site posts, or 61 percent of the total. La Tercera reaches the same general conclusion: Chile was identified as one of the countries where international data hijacking and credential theft groups operate actively, affecting the public sector, critical infrastructure, financial services and major companies. The article also describes Qilin as an RaaS group specialized in automated campaigns and abuse of poorly managed cloud configurations, and The Gentlemen as another active actor in Chile, focused on double extortion.

Ransomware.live adds operational context. Its Chile page reports 74 victims linked to organizations in the country, all aggregated from leak-site posts. Among the victims attributed to Qilin in 2026 are Valbifrut, Graneles de Chile, Noi Hotels, SAAM Towage, Calidra and Comercial Echave Turri Limitada. Their discovery dates cluster between January and May 2026, reinforcing the idea of sustained activity rather than an isolated event. Ransomware.live also tracks other actors such as LockBit5, Incransom and Anubis, confirming that the local environment is fragmented across several extortion families and brands.

There are also sector signals. SEK’s report summary, cited by G5 Noticias, places Government at the top with 10 combined incidents, followed by Finance with 8, Education with 6, Health with 6 and Energy or Mining with 5. That not only identifies high-value sectors, it also points to where exposed systems may be located and where the operational impact could be most severe if encryption or exfiltration occurs. NOI Hotels expands the picture into tourism and hospitality, a segment that depends heavily on operational uptime and guest data protection.

A Care Telecom reference mentions a clinic in Chile among 15 new victims claimed by Qilin during a 72-hour window in the first week of June 2026. The source does not identify the clinic by name, so the claim cannot go beyond an indication of health-sector exposure. Even so, it fits the broader regional pattern, where Qilin targets organizations that do not always have strong controls over remote access, segmentation or incident recovery.

Paraguay

Paraguay appears in the corpus in two ways. The first is institutional. Check Point Research reports active exploitation of CVE-2026-50751 in remote access gateways and says at least one case was linked to Qilin ransomware activity. The indexed excerpt of the report also includes Paraguay in that context, although the material does not let us attribute a specific victim or determine whether the country was hit by the same campaign or simply referenced in the document.

The second appearance is operational. Ransomware.live’s Mexico panel includes an entry associated with Qilin that mentions Healthcare S.A. as a victim and describes it as a Paraguayan family-founded company, with the case discovered on June 15, 2026. The material does not clarify whether the incident affected operations in Paraguay, Mexico or a transnational corporate structure. What can be verified is the entity’s presence in the tracker and its association with Qilin.

Legal-ISAC, for its part, shows at least one Qilin-associated victim in Paraguay on its RansomWatch dashboard, classified in the information technology sector. That confirms the country is already appearing on ransomware tracking radars with activity attributed to the group. Added to that is an unconfirmed Instagram post describing an attack against the private clinics Migone, Grupo Británico and Reyva, with interruptions in medical records, appointments and billing. That information is not corroborated by an institutional source, so it should be treated as an indicator, not as a settled fact.

La Tribuna Paraguay also reported a ransomware attack attributed by a group calling itself CyberTeam against InfoCheck, linked to Equifax Paraguay. That item is confirmed in the corpus, although it does not establish any link to Qilin. Paraguay, then, shows ransomware activity, but the material does not support the conclusion that all of it belongs to the same actor.

Bolivia

Bolivia appears with less volume, but with clear thematic relevance. Scrutex.ai reported that Qilin led the posts on its leak site during the week under analysis with 25 victims, equal to 13 percent of the total. Within that universe, Bolivia is listed among the countries with between one and three affected organizations, although the report does not publish specific names. The same report identifies Qilin as an actor that mainly exploits edge vulnerabilities, remote management tools and hypervisors, and explicitly highlights Fortinet flaws CVE-2024-21762 and CVE-2024-55591 as entry points.

The value of that reference is not only Bolivia’s presence, but the technical similarity with what was seen in Chile and elsewhere in the region. Scrutex.ai cites PRODAFT and ReliaQuest in saying that tens of thousands of Fortinet devices remained exposed months after patching. If the perimeter stays open, the spillover effect in countries with less public visibility becomes difficult to measure but no less real. Orbital Laika reinforces that reading by explicitly mentioning threats in Bolivia in the context of Fortinet’s global FortiGuard report.

The material also includes two LinkedIn posts that, unconfirmed, say Krybit may have affected Bolivia’s Agency for Health Infrastructure and Medical Equipment, AISEM. Both posts describe a disruption to health and medical equipment infrastructure, but there is no official statement or technical detail on the access vector. They should therefore be read as signs of possible exposure, not as conclusive attribution.

Peru

There are no additional verifiable facts in the research for Peru. The corpus provides no confirmed victims, attributed campaigns or specific technical data for the country.

Colombia

There are no additional verifiable facts in the research for Colombia. The material contains no confirmed victims or campaigns tied to the country within the consolidated sources.

Brazil

Brazil is the other major regional reference point alongside Chile. La Tercera, citing a Fortinet study, says the country accounted for about 30 percent of ransomware victims in the region and saw 309 million phishing attempts in 2025, equal to 588 attacks per minute. That data is paired with a broader claim in the same article: Brazil is one of the countries where international data hijacking and credential theft groups operate actively against the public sector, critical infrastructure, financial services and major companies.

On the technical side, Check Point Research published a phishing campaign in Brazil that abuses the legitimate NinjaOne agent to install a signed agent on corporate devices, using Portuguese-language portals and social engineering phone calls. Although the case is not directly tied to Qilin, it does confirm heavy use of legitimate remote access to compromise endpoints in the country. The same report also mentions active exploitation of CVE-2026-50751 with one case linked to Qilin, reinforcing the idea that the group is following remote-access flaws closely.

CM Alliance adds another element. On June 22, 2026, Brazil was investigating a possible cyberattack against Defesa Civil Alerta, a platform under the National Secretariat for Protection and Civil Defense, after false emergency warnings were sent to thousands of mobile phones and the system was temporarily disconnected. The source does not attribute the event to Qilin, but it places the incident within a particularly active June for high-impact events in the country.

In terms of ransomware, Red Piranha places Brazil within a weekly report where The Gentlemen leads global activity and Qilin ranks second. The same document describes Securotrop, a Qilin-affiliated brand, and records activity in Brazil and Chile. Care Telecom also mentions a food-sector company in Brazil among the alleged victims claimed by Qilin during a 72-hour window in the first week of June. That reference is unconfirmed, but it fits the regional leak-site expansion pattern.

United States

There are no additional verifiable facts in the research for the United States within this regional section. There is, however, an indirect relevant reference: several technical analyses of Qilin and FortiBleed mention campaigns or victim clusters in U.S. law firms and consultancies, but the corpus provided here did not develop a country-specific block with concrete events for that jurisdiction.

Technical indicators

No classic IOCs, such as hashes, domains, IPs or file paths, were published in the consolidated material. There are, however, behavior indicators, vulnerable versions and operational artifacts that are useful for defense and hunting.

Security team analysis

The defensive priority that emerges from the material is not ambiguous. Initial access remains the point of failure, and in this campaign initial access is closely tied to the perimeter. If an organization exposes FortiGate, FortiProxy or remote-access gateways without enough hardening, the attack surface matches the pattern seen in Qilin and the FortiBleed ecosystem. The fact that CISA, the Canadian Centre for Cyber Security and other national teams issued alerts within a narrow time window suggests the issue has moved beyond a single vulnerability.

At the operational level, the first step is to stop treating the firewall or VPN as just a transit point. In the material reviewed, those devices appear as compromise targets, persistence points and credential collection points. Devel Group describes ghost administrative accounts. The Hacker News describes an automated attack that first tests credentials and then captures authentication traffic. Bitsight adds that theft can continue offline through hash cracking. For that reason, hardening has to include not just patching, but also account hygiene, secret rotation and review of historical configuration.

The next layer is detection. ProvenData offers a useful set of signals: anomalous VPN or RDP logins from unusual times, locations or devices, domain admin activity from non-administrative hosts, mass LSASS access, bulk deletion of shadow copies, coordinated service termination and driver loads that do not match the endpoint baseline. In Fortinet environments, Devel Group recommends looking for abnormal executions of diagnose sniffer packet and auditing accounts with names designed to look like legitimate support. If the monitoring stack is not seeing those events, the first objective should be to enable enough telemetry to capture them.

Mitigation guidance is consistent across sources. Rotate administrative and VPN passwords immediately, enforce MFA, update FortiOS to the latest available version, close external administration unless it is truly necessary and restrict access to trusted hosts. When possible, external administration should be eliminated entirely. The Canadian Centre for Cyber Security and Fortinet, according to The Hacker News coverage, also recommend ending compromised administrative and VPN sessions and assuming prior credentials may have been reused from earlier incidents. That assumption matters because FortiBleed does not depend on a single vector, but on the combination of technical exposure and already leaked credentials.

For Chile, the risk reading is even more urgent. The 58 incidents between January and June 2026 and the 50 percent increase in DLS posts compared with the same period in 2025 show that the problem is persistent. The mix of targeted sectors, Government, Finance, Education, Health and Energy or Mining, suggests the adversary understands where operational and reputational impact can be maximized. For organizations that depend on ESXi hypervisors, defense should include segmentation, least privilege on admin tools and tested restoration plans. Qilin targets hypervisors because that speeds up damage across multiple systems. If ESXi is not protected, containment arrives too late.

Source limitations

The available corpus supports a strong technical and regional line of analysis, but it does not justify closing several specific attributions. The mentions of ATCOM Chile, the clinic in Chile, the food company in Brazil, AISEM in Bolivia, Healthcare S.A. in Paraguay and the private Paraguayan clinics appear in sources with varying levels of reliability, several of them using unconfirmed attribution language. For that reason, they are not treated as fully verified incidents in this research.

There are also no classic IOCs in the consolidated sources. No hashes, IP addresses, C2 domains or DLS URLs were provided in a way that offers direct operational value for technical hunting. What is available are tool names, abused commands, vulnerability families and fraudulent accounts observed by the cited researchers.

Another limitation is the geographic imbalance. Chile carries the strongest and most quantifiable evidence. Brazil appears with substantial context, but with less direct attribution to Qilin in specific incidents. Paraguay and Bolivia have signs of exposure and monitoring in intelligence platforms, but without the same density of detail. Argentina, Peru, Colombia and the United States do not contribute additional verifiable facts within the regional block requested.

Finally, the information on FortiBleed is abundant but heterogeneous in its scale estimates, ranging from more than 30,000 devices to 86,644 compromised FortiGate systems. That spread does not invalidate the campaign, but it does mean the numbers should be treated as estimates from different research teams, not as one consolidated total.