Qilin and Securotrop in Q2 2026

Operation timeline

Attack chain and TTPs

The material supports a partial attack chain, not a complete playbook. The verified starting point is exploitation of CVE-2026-50751 on Check Point devices with legacy IKEv1 configurations. That technical condition matters because it narrows the potential victim set to organizations that kept legacy remote access, did not require machine certificates, and exposed VPN gateways to the internet. Once inside, the remote session was established without valid credentials, avoiding the usual stage of password theft or brute forcing.

After initial access, Check Point observed attempts to download ELF payloads from attacker-controlled infrastructure. That suggests a post-exploitation phase aimed at Linux systems. The reference does not identify the downloaded binary or its exact purpose, but it does support the view that the attacker did not stop at obtaining an interactive session. There was intent to execute or stage additional payloads from owned servers.

Red Piranha adds a useful piece for understanding Qilin behavior. In a sample analyzed in ANY.RUN on June 4, 2026, the ransomware runs `vssadmin delete shadows /all /quiet` to remove shadow copies in Windows and creates logs under `QLOG\ThreadId(1).LOG`. That combination is consistent with classic ransomware goals, where shadow-copy deletion hinders recovery and the internal log helps with execution tracking or operational debugging. The finding does not by itself prove authorship of the incident at ATCOM or in other local victims, but it does fit Qilin's operational profile.

Securotrop's attribution deserves its own reading. Red Piranha describes it as a group established in early 2025 that operates within Qilin's affiliate network, maintains its own Data Leak Site, and uses Qilin software without altering the original code. That last line, reported as the group's own public statement, is a sign of an affiliate brand. This is not a different malware family, but an operational label that shares tooling and, likely, extortion infrastructure. The overlap between the onion addresses of Securotrop's DLS and a Qilin extortion link, confirmed by independent trackers, reinforces the relationship.

TTPs observed or attributed

Regional impact

Regional overview

The regional material shows distributed and uneven Qilin activity, not a single homogeneous campaign across Latin America. Chile accounts for the largest share of public references, both because of the ATCOM discussion and because of the mapping of other victims attributed to the group. Argentina appears in third-party reports and in coverage of the VPN campaign, but without enough public traceability to reconstruct an individual case with IOCs. Bolivia appears in Scrutex's weekly reporting as one of the countries with claimed Qilin victims during the June 8 to 14 period. Peru shows isolated cases and aggregate statistics, and Colombia is more closely tied to sector alerts from the financial system than to a full intrusion dossier. Brazil and Paraguay do not add further verifiable facts in the material provided.

Argentina

In Argentina, the useful material is brief but consistent on one point. On June 11, DeXpose said Qilin had supposedly attacked Axionlog, described as a leading logistics services provider in the country, and warned about possible exposure of sensitive data. That claim remains source-attributed and not independently confirmed, because the material provides no IOCs, vectors, or technical evidence to support it on its own.

The second relevant element is broader and comes from Check Point Research, which in its June 15 report included references to organizations affected in several countries, including Argentina, within the CVE-2026-50751 campaign. The available material does not name other Argentine victims tied to that exploitation, but the country's inclusion confirms that the campaign had regional reach and was not limited to the United States or Europe.

The CM-Alliance article published on July 1 strengthens that geographic reading by placing Argentina within its coverage of the biggest cyberattacks in June and summarizing the link between the VPN zero-day and Qilin. It adds no new victim or vector details, but it does show the campaign remained relevant at the end of the month.

Chile

Chile is the country with the highest density of facts in the corpus. On June 18, FalconFeeds.io reported that ATCOM Chile, a staffing and outsourcing company based in the country, had allegedly been victimized by Qilin. The next day, Cyber News Live, Undercode News, Hendry Rahardja, and the user chum1ng0 repeated similar versions, some based on the group's own claims and others on dark web references or an alleged leak listing. The pattern is clear, but the evidence remains open-source attribution rather than full technical confirmation.

ATCOM matters because of the type of company it is, not just because of the name. The sources describe it as an outsourcing, staffing, and recruitment player that places workers across the country. In that context, a ransomware incident affects personal data, operational continuity, and third-party services for multiple clients. However, the available material does not include IOCs, malware samples, or a forensic note that would allow anything beyond the public claim. That is why the piece should keep the alleged or presumed label when referring to ATCOM.

The case becomes more interesting when cross-referenced with ransomware.live's map for Chile and the "Chile under RaaS pressure" analysis. The map, updated at the end of June, recorded 74 victims in the country and listed Comercial Echave Turri Limitada as attributed to Qilin with a discovery date of 2026-05-17. The same page includes other Chilean organizations associated with groups such as Qilin, LockBit5, and Anubis, including Noi Hotels, Graneles de Chile, and Copec S.A., although the public detail is not enough to verify each association.

The LinkedIn Pulse article from June 24 adds another layer by characterizing Qilin as a financially motivated double-extortion ransomware-as-a-service group and, in the Chilean context, listing Valbifrut, Ducasse, Conectados Chile, Graneles, and Noi Hotels as victims linked to Qilin. That piece also says the pressure on the Chilean ecosystem follows the classic double-extortion model, with encryption and threat of data publication. The lack of case-specific TTPs means that relationship has to be treated as a higher-level analytical frame, not as individual confirmation of each attack.

The infrastructure link between Qilin and Securotrop also matters in Chile because it helps explain the reuse of brands and extortion machinery. If Securotrop operates as an affiliate within Qilin, then the fact that different sources mention Qilin or a claim on its leak site does not necessarily contradict the same operating chain. It may be the same criminal economy, presented under different public brands depending on the affiliate or the phase of the extortion cycle.

Paraguay

No additional verifiable facts are available in the supplied material for Paraguay. The absence of records should not be read as the absence of activity, only as a lack of documentary support in the corpus provided.

Bolivia

Scrutex included Bolivia in a group of 30 countries that had between one and three claimed victims during the June 8 to 14, 2026 week. In that same period, Qilin led the activity with 25 posts on its leak site and 45 affected countries, according to the report's tally. The data is useful because it shows regional reach and confirms that Bolivia was not outside the group's weekly claim cycle.

Scrutex adds a methodological nuance: researchers at PRODAFT and ReliaQuest linked the global rise in Qilin activity to continued exploitation of a vulnerability in VPN devices. The report does not tie that technique to Bolivian victims in particular, nor does it identify specific incidents in the country. The most cautious reading is therefore that Bolivia appeared in Qilin's public claims during the same week the VPN campaign was in full circulation, with no further precision.

Peru

Red Piranha's June 2 to 8 report noted isolated ransomware incidents with victims in Peru, equal to roughly 0.74 percent of global cases in that period. The document does not specify which groups were involved, so the data has to be treated as statistical context rather than a Qilin attribution.

Even so, the same report helps place Securotrop within the Qilin ecosystem and extend the technical reading to the regional environment. Red Piranha describes Securotrop as an affiliated group, with its own DLS and the original Qilin software, and says the onion address of Securotrop's leak site also appears as a Qilin extortion link in a public tracker. In other words, the operational environment affecting Peru is not limited to one name, but to a set of connected brands and leak sites.

Red Piranha also contributes a useful technical piece on Qilin's behavior. In a sample analysis dated June 4, it documented the execution of vssadmin delete shadows /all /quiet and the creation of QLOG\ThreadId(1).LOG log files. That evidence does not point to a specific Peruvian victim, but it does show the kind of execution one can expect in an intrusion attributed to the Qilin family or its affiliate network.

Colombia

Colombia appears in the material from a sector and shared-intelligence angle. Ransomware.live maintains a country page where it tracks alleged victims and discovery dates, including activity attributed to Qilin. The corpus does not provide the detail of each Colombian entry, so the mention functions more as a public tracking signal than as a complete technical case file.

The other information stream comes from the financial sector. Chrysalis Ciberseguridad reported on June 9 that the Financial CSIRT of Asobancaria in Colombia shared information about a "cyber risk" affecting a critical vendor in the country's financial sector. A June 16 post by Alberto Flores Merino reinforced that reference and framed it with hashtags such as #ransomware, #vpn, #checkpoint, #cisa, and #zerotrust. The material does not explicitly say the case is Qilin, but the contextual link to the Check Point campaign and the regulatory urgency is clear.

That pattern matters operationally. Alerts from the Colombian financial ecosystem appeared in the same time window in which CISA and Check Point were publishing warnings about CVE-2026-50751. Although the material does not let us directly tie the Colombian case to a confirmed Qilin incident, it does suggest that exposure of critical vendors to legacy IKEv1 VPNs was a shared regional problem.

Brazil

No additional verifiable facts are available in the supplied material for Brazil. This subsection is left explicit to respect the required structure and avoid unsupported inference.

United States

The United States functions in this corpus as the regulatory and technical observation center. On June 9, CISA ordered FCEB agencies to patch CVE-2026-50751 by June 11, after confirming its exploitation in zero-day attacks by Qilin affiliates. That order was based on the flaw's inclusion in the KEV catalog, which accelerated priority remediation in regulated environments.

The CISA notice cited by BleepingComputer explained that the bug let remote unauthenticated attackers bypass authentication and establish a remote access VPN connection on Check Point Mobile Access/SSL VPN, Remote Access VPN, or Spark devices. Rapid7 added that the flaw was limited to legacy IKEv1 deployments without machine certificates, and that the operational exposure had been limited to a few dozen organizations by early June.

SecurityWeek complemented that picture by reporting that [at least one attack had been confirmed as carried out by a Qilin affiliate](https://www.securityweek.com/check-point-vpn-zero-day-exploited-in-qilin-ransomware-attacks/) and that Check Point assessed the link to that family with medium confidence. BleepingComputer and CybersecurityDive highlighted the coordinated response, which included emergency patches, log review, and disabling IKEv1. The Register, for its part, placed the timeline at an initial stage on May 7 and a visible increase in early June.

The material also mentions Securotrop in an unconfirmed U.S. case. Hendry Rahardja posted about Charisma Media, a U.S.-based organization, as a possible Securotrop victim, with 808 GB of claimed data. That case remains unconfirmed and should not be mixed with the confirmed facts tied to the Check Point campaign.

Technical indicators

No additional operational domains, full onion addresses, concrete IPs, or binary samples with enough hash data were identified in the supplied material to extend the IOC list beyond what the sources already cited. The corpus does mention that Check Point published IP blocks associated with the campaign, but the consolidated text does not include the full values, so they should not be invented.

Analysis for security teams

The first operational reading is straightforward. If an organization still has Check Point Remote Access VPN or Mobile Access with IKEv1 enabled and no machine-certificate requirement, the exposure is not theoretical. The material shows real-world exploitation, association with ransomware activity, and an emergency response from the defense ecosystem. The priority should be to review whether legacy deployments remain, confirm patching, disable IKEv1, and verify that remote clients do not depend on that protocol.

The second reading is about detection. Check Point recommended reviewing logs for unauthenticated VPN connections. On top of that, teams should look for post-exploitation patterns, especially attempts to download ELF payloads from actor-controlled infrastructure. In Linux or mixed environments, that detail can mark the shift from initial access to remote execution. In Windows environments, shadow-copy deletion through vssadmin delete shadows /all /quiet remains a useful sign of later ransomware activity.

The third reading is about prioritization. The Register and Rapid7 indicate that the campaign affected only a few dozen organizations globally, but that does not reduce the risk for those that fell within the vulnerable surface. The target profile, exposed VPNs and single perimeter controls, is typical of ransomware affiliates. That means the exposure does not just compromise remote access, it also opens a path for exfiltration, lateral movement, and double-extortion pressure.

For teams monitoring Latin America, the Chile case should be read on two levels. One is the level of publicly claimed victims, where ATCOM appears as a presumed target and other names, such as Graneles de Chile and Noi Hotels, show up in trackers or third-party analyses. The other is the infrastructure and brand layer, where Securotrop operates as a Qilin affiliate with its own Data Leak Site. If an organization sees mentions of Qilin, Securotrop, or leak-site claims, it should assume the phenomenon may be sharing capabilities, not competing with itself.

In regulated sectors, especially financial services and critical infrastructure, the presence of CSIRT alerts and references to VPN, Check Point, and CISA should trigger priority review of perimeter controls. The Colombian signals show that this pressure has already reached critical vendors. The main risk is not only encryption, but persistent initial access before detection, with the possibility of prior exfiltration and later extortion.

Material limitations

The available corpus mixes high-confidence sources with publications explicitly marked as unconfirmed, especially in the ATCOM case and in several claims spread through social media and aggregation sites. That requires distinguishing between a technically supported incident and a public claim repeated by third parties. In particular, ATCOM Chile is cited as a presumed Qilin victim in FalconFeeds.io, Cyber News Live, Undercode News, Hendry Rahardja, and chum1ng0, but the material does not include independent validation that would close attribution.

There is also no uniform package of IOCs, binaries, or forensic telemetry for Chile, Argentina, Bolivia, Peru, or Colombia. The report rests on threat intelligence sources, public trackers, and analyst posts. That is enough to map trends, but not to rebuild a full forensic timeline for each victim. In several cases, the level of detail is reduced to organization names and supposed leak-site claims.

On Securotrop, Red Piranha offers a solid thesis on affiliation and shared infrastructure, but its own report distinguishes between CONFIRMED and ATTRIBUTED techniques. There is not yet an independently documented Securotrop incident with the same level of granularity as the CVE-2026-50751 campaign. For that reason, it would not be appropriate to extend all of Qilin's TTPs to every mention of Securotrop without qualification.

Finally, the consolidated material does not provide verifiable links between any specific local case and exploitation of CVE-2026-50751 across all the countries mentioned. Argentina appears in the Check Point Research report, Colombia in sector alerts, and Bolivia or Peru in weekly statistics, but there is no single line connecting each country to the same technical incident. That fragmentation is a limitation of the corpus, not of the phenomenon.