Securotrop Ransomware

Securotrop is a ransomware group established in early 2025 that operates within the Qilin affiliate network while maintaining an independent public Data Leak Site identity. Threat intelligence platforms classify Securotrop under the Qilin cybergroup, and the group has publicly stated that it uses Qilin software without altering the original code. This places Securotrop firmly in the category of a Qilin-linked affiliate brand rather than a separate malware family.

Infrastructure overlap between Securotrop and Qilin has been confirmed through multiple independent tracking sources. The Securotrop DLS onion address (securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion) is also listed as a Qilin extortion link in the Qilin tracker.

Tactics, Techniques, And Procedures (TTPs)

TTPs use two status labels:

CONFIRMED: Directly evidenced from Securotrop-specific DLS monitoring, victim intelligence, IOC tracking, or the confirmed statement that Securotrop uses unmodified Qilin code combined with cross-validated family-level evidence.  

ATTRIBUTED: Sourced from Qilin-family technical analysis. These represent the inherited tradecraft Securotrop deploys via unmodified Qilin tooling. No Securotrop-branded incident report has independently confirmed these techniques; attribution is grounded in the confirmed codebase relationship.

Indicators Of Compromise (IOCs)

IOCs are presented in three tiers:

(1) Securotrop-specific confirmed IOCs (infrastructure and contact artefacts);

(2) Qilin-family sample hashes applicable to Securotrop deployments given the confirmed codebase identity; and

(3) Qilin-family behavioural artefacts applicable via the same relationship. All status labels are explicit.

Securotrop-Specific Infrastructure and Contact IOCs

Encryption Algorithm Identifiers

Qilin-Family Malware Sample Hashes

AV and EDR Detection Names

Host-Based Behavioural Artefacts

Mitigation - Crystal Eye 5.5 Controls

• CE Advanced Firewall + IDPS + Forcefield Zone-segment remote access, backup, and critical server tiers. Attach IDPS profiles (Detection & Protection mode) to internet-facing and east-west interfaces. Enable Forcefield on all admin-facing services to auto-block IPs on repeated authentication failures. Enable CE Anti-phishing for credential-harvesting site blocking.
• CE Anti-phishing + Web Filter + Antivirus + Application Filter Enable CE Anti-phishing, Web Filter (HTTP/HTTPS), and Antivirus with block-encrypted-files mode. Constrain zip recursion depth and archive size limits. Use CE Application Filter to restrict File Sharing, Mail, and Messaging categories. CE Protocol Filter blocks protocols by content, port, or traffic type. Optional Anti-malware File Scanner quarantines flagged files from network shares.
• CEASR + CE MDR CEASR ML3 policies restrict unauthorised Group Policy modification and LSASS access, blocking GPO-based Chrome credential harvesting and Mimikatz dumping. CE MDR alerts on anomalous PowerShell targeting Chrome user profile paths. Enforce enterprise password management to eliminate browser-stored credentials.
• CE IDPS + ZTNA Micro-segmentation Configure CE IDPS local rules to detect PsExec-driven SMB propagation. Restrict SMB (TCP 445) between zones via CE Advanced Firewall to authorised flows only. Crystal AI detects lateral movement in real time. Block RSAT-AD-PowerShell installation via CEASR application allowlisting.