Newcomer Qiulong Ransomware Targets Brazil

The newcomer Qiulong ransomware gang announced 2 victims in Brazil. These are Dr. Lincoln Graca Neto and Rosalvo Automoveis. The hackers posted short summaries of the targets on their new website, along with some mocking remarks for Dr. Lincoln.

• According to the hackers’ OP, Dr. Lincoln Graca Neto appears to have either rejected negotiations or did negotiate but refused to pay the ransom
• It appears that Rosalvo Automoveis hasn’t contacted the hackers yet, as they still have little over 7 days available for that
• Qiulong is a new and still unknown ransomware gang that already appears to be well-armed and ready to make waves
• Preliminary investigations hinted at the organization being of Brazilian origins, but this hasn’t been confirmed yet

2023 has seen a surge in ransomware breaches, up 55% compared to the previous year. This is both due to veteran gangs ramping up their activity and new-coming ransomware actors trying to make a name for themselves. Qiulong is one of them.

But what do we actually know about Qiulong, as little as that may be? The first thing is that Qiulong (sometimes Qiu) stands for “horned dragon” in Chinese. Or “hornless dragon,” depending on the context. This seems to imply an Asian descent for the gang.

But the reality of it contradicts that, as Qiulong appears to be based in Brazil. So, we already have an attempt at forging a fake identity, which is standard in the ransomware sphere.

Other than that, everything is in the dark. Qiulong made itself known several days ago, so it’s probably the newest and youngest ransomware gang today. This makes it impossible to predict anything about it, including where it will be tomorrow.

In terms of MO and tactics, Qiulong appears to make use of the tried-and-tested double-extortion strategy. This involves encrypting the victim’s system and stealing valuable data at the same time. This gives the hackers extra leverage during negotiations.