Qilin encrypts a game studio's ESXi version control and build environment

The client is a mid-sized game studio of just over a hundred people, working on an unreleased mobile title while shipping updates for a live product. Its development infrastructure sits on three ESXi hosts: Perforce and GitLab repositories, automated build machines, internal test servers, art asset servers and test environments — just over thirty virtual machines, all on datastores backed by a single SAN.

Outsourced artists and remote staff reach the development network over one SSL VPN, and several VPN accounts had no multi-factor authentication, including a long-dormant contractor account with a weak password. The virtualisation management plane was directly reachable from the office network, and operations staff routinely saved the vCenter password in a browser.

The incident happened late on a July weekend. On Monday morning the lead programmer found the repositories unreachable and vCenter rejecting logins. From the ESXi console the guests had been powered off within the same window; vmdk and vmx files in the datastore carried an appended random string, ransom notes named README-RECOVER-[random].txt sat under /vmfs/volumes, and every VM snapshot had been deleted. The note, customised for the victim, named the unreleased project by codename, supplied a Tor entry point with a per-victim company ID and threatened to publish the stolen art and design documents.

The Veeam repository was mounted over iSCSI from the same storage and was damaged with it, with no offline copy; the array snapshot policy covered only the two volumes holding the repositories and art assets.

Containment went out on the first call: keep the ESXi hosts powered but off the network; do not reinstall a host, create or resignature a datastore, or power on guests. In parallel the storage administrator suspended snapshot reclamation and overwrite policies on the array so usable restore points would not age out.

• Evidence and imaging. Block-level read-only images of the LUNs, plus hostd.log and vmkernel.log, SSH logon records and authorized_keys, vCenter event logs, and VPN and firewall records. All later work ran on copies.
• Family confirmation and recoverability assessment. Qilin uses no fixed extension, so the family was confirmed from the match between README-RECOVER-[random].txt and the extension string plus the RSA-wrapped block at the file tail — a Qilin ESXi encryptor. No public, free decryptor exists, so decryption was ruled out. Segmented entropy mapping of representative -flat.vmdk files showed skip-step intermittent encryption: large disks kept long intact stretches, while partition tables and the vmx and vmsd files of some guests were fully overwritten.
• Recovery. Three paths ran together: roll back the volumes holding the repositories and art assets from surviving array snapshots; for guests the snapshots did not cover, rebuild vmdk descriptors and the vmx, mount the disks and export Perforce depot and GitLab data from intact ranges; then close the gap after the snapshot point from developers' and artists' local working copies and archived build outputs. All work ran in an isolated environment with per-guest filesystem, repository and asset checksum verification.
• Attribution, exposure assessment and hardening. The intrusion chain was reconstructed, the exfiltration window and volume established, and directory listings compared to scope the art assets, design documents and test-account data involved. Hardening ran alongside: MFA on every VPN account and dormant ones removed, contractor access moved onto a controlled path authorised per work order, the management plane isolated with lockdown mode on, persistent SSH disabled, browser-saved operations credentials banned, and the backup repository separated from production storage with immutable backups.
• Deliverables. Recoverability assessment, recovery inventory with an explicit data-gap list, exposure assessment and notification recommendations, and an attribution and hardening report with follow-up guidance. No ransom was paid and there was no contact or negotiation with the attackers.