Qakbot (Qbot) — This password-stealing malware just evolved a new tactic to remain hidden

guest · May 3, 2019

This password-stealing malware just evolved a new tactic to remain hidden
Windows malware campaign re-emerges with new techniques for attempting to stay under the radar
May 3, 2019
https://www.zdnet.com/article/this-...e-just-evolved-a-new-tactic-to-remain-hidden/

The new obfuscation technique has been detailed by cybersecurity researchers at Cisco Talos.
The new downloader always requests resources from the same Uniform Resource Identifier on the hijacked domains which are XOR encrypted in order to help obfuscate the malicious data contained in a JavaScript downloader and allow the malware to go about its tasks.

This is also helped along by the malware now being divided into two separate files which are only reassembled to deploy Qakbot when the dropped executable is run – making it more difficult for anti-virus software to detect.

"Detection that is focused on seeing the full transfer of the malicious executable would likely miss this updated version of Qakbot. Because of this update to persistence mechanisms, the transfer of the malicious Qbot binary will be obfuscated to the point that some security products could miss it," said Ashlee Benge, security researcher at Cisco Talos.
Click to expand...

Cisco Talos: Qakbot levels up with new obfuscation techniques

[...] the malware is obfuscated when it is downloaded and saved in two separate files. These files are then decrypted and reassembled using the type command.
Click to expand...

Sampei Nihira · May 3, 2019

This is the classic example of a problem where Windows XP is immune.

itman · May 3, 2019

Sampei Nihira said: ↑

This is the classic example of a problem where Windows XP is immune.
Click to expand...

How is XP immune from this?

It runs scheduled tasks, cmd.exe, and wscript.exe all components in this attack.

Sampei Nihira · May 3, 2019

In Italy it's 9:25 pm we'll talk about it tomorrow, in my late afternoon:

itman · May 4, 2019

Sampei Nihira said: ↑

In Italy it's 9:25 pm we'll talk about it tomorrow, in my late afternoon:
Click to expand...

Windows Task Scheduler, i.e. schtask.exe, is located in C:\Windows\System32 directory for starters.

Next open a command prompt windows as admin. Where does it point to?

Believe you got confused with this .bat code:

Once way the .bat script could run on XP is with admin privileges. I believe on XP does not the default account run w/full admin privileges?

Also I am confused by your command prompt display on XP. If I recollect is not the \Documents and Settings\User directory the equal to my below screen shot for non-admin command prompt on Win 10? In any case, specifying the full path name should do the trick. Or add, "cd C:\Windows\System32" to the script prior to the schtask.exe script code line.

In reality though, the malware authors probably assume no in in their right mind is still using Win XP for any kind of Internet financial activities. Therefore, you might be indeed immune from this.

Sampei Nihira · May 5, 2019

The cmd prompt is already at the administrator level.
No confusion, there is no Schtask.exe in System32.

Regarding the command prompt path, the path is regular.
I recently added some specific custom commands to the winapp2.ini (CCleaner) file for my New Moon (no installer) and Interlink MailNews (no installer) and I had to be careful about environment variables like see different XP and Vista / W .10:

Environment variables:

https://github.com/MoscaDotTo/Winapp2

XP is immune,period.

roger_m · May 5, 2019

Sampei Nihira said: ↑

No confusion, there is no Schtask.exe in System32.
Click to expand...

In XP, it's mstask.exe, not schtasks.exe, so you are right, it won't run.

Sampei Nihira · May 5, 2019

roger_m said: ↑

In XP, it's mstask.exe, not schtasks.exe, so you are right, it won't run.
Click to expand...

Certainly.
Thank you for the confirmation.
And there are multiple other factors why today's malware won't run on Windows XP.

itman · May 5, 2019

A few finally comments.

To begin with, Qatbot and like class financial malware doesn't target individual's; its targets are financial institutions and concerns. So the discussion of whether a standalone XP PC is vulnerable or not is immaterial.

That said, don't fool yourself that if an attacker of this class wants to attack a source, he won't first perform recon activities on the target in regards to system particulars and then delivery the appropriate payload.

guest · Jun 15, 2020

Targeting U.S. banks, Qbot trojan evolves with new evasion techniques
June 15, 2020
https://www.scmagazine.com/home/sec...t-trojan-evolves-with-new-evasion-techniques/

By malware standards, the banking trojan Qbot is long in the tooth, but it still has some bite, according to researchers who say it has added some detection and research evasion techniques to its arsenal.

“It has a new packing layer that scrambles and hides the code from scanners and signature-based tools,” wrote Doron Voolf, malware analyst at F5 Labs (part of F5 Networks), in a recent company blog post. “It also includes anti-virtual machine techniques, which helps it resist forensic examination.”
F5 Labs discovered the new additions while analyzing a Qbot sample that was detected earlier this year.

Active since 2008, Qbot is designed to collect victims’ browsing activity and steal their bank account credentials via keylogging, credential theft, cookie exfiltration, and process hooking, Voolf notes.
This latest sample was programmed to harvest credentials primarily from U.S. banks and their online financial services offerings.
Click to expand...

F5 Labs: Qbot Banking Trojan Still Up to Its Old Tricks

Qbot has been around for a dozen years with pretty much the same functionality. The targets changed and features were added, but it’s still primarily about keylogging and, secondarily, about extracting a victim’s personal data.
As Qbot waxes and wanes in popularity with attackers, it is hard to gauge its overall impact on a global scale. However, it is still a viable threat for defenders to be aware of.
Click to expand...

guest · Aug 22, 2020

New QakBot Campaign Is Showcasing Novel Detection Evasion Techniques
The QakBot banking trojan has broken its malicious functionality into chunks, and AVs have trouble detecting it
August 21, 2020
https://www.technadu.com/new-qakbot-campaign-showcasing-novel-detection-evasion-techniques/179285/

A QakBot/QBot campaign that started a couple of weeks back is showing new ways of evading detection of analysis, so it appears that the author of the widely known and used banking trojan has pushed a fresh version out in the wild. Morphisec researchers have sampled these new variations and give details on what’s changed in a report.

As they say, the method of distribution remains the typical macro-ridden documents that arrive in attached ZIP archives via email messages. These Word files run PowerShell scripts that fetch the QakBot payload from the C2, but this is where following the trodden path ends.
Click to expand...

The first new technique that comes with the latest QakBot version is a new “content disarm and reconstruction” (CDR) technology that is meant to help pass through security checks and filters.
This is done by ZIPing the malicious document instead of sending it as a Word file, a simple yet very effective method of bypassing email defenses.

Morphisec says the distributed behavior and breaking of the functions in smaller chunks makes it more challenging for some AVs to catch the threat. Still, in general, the most reputable tools should work as expected.
Click to expand...

Morphisec: QakBot (QBot) Maldoc Campaign Introduces Two New Techniques into Its Arsenal

Morphisec identified an increase in QBot delivery during the last several months. EDRs / AVs have a hard time detecting distributed behaviour in which not a single process does something malicious but all the processes combined act in a malicious way.
Click to expand...

guest · Aug 27, 2020

Fortinet:
Deep Analysis of a QBot Campaign – Part I (June 11, 2020)

I performed a deep analysis on this sample file. QBot uses complicated techniques and a framework designed for it to run covertly on a victim’s system. In this post, I will explain how it works on a victim’s machine, as well as what techniques it uses.
QBot copies its entire data from its memory into explorer.exe’s memory. [...] QBot is perfectly running within explorer.exe process.

In the first part of this report, I provided a detailed explanation of how this variant of QBot is downloaded by an Office Word document by using a malicious Macro, and how it uses complicated techniques to hide and protect itself from being recognized by the victim.
During my analysis, QBot kept upgrading its payload file, almost once a day. I’ll keep tracking its actions and posting more analysis for it when some new features have been added.
Click to expand...

Deep Analysis of a QBot Campaign - Part II (July 8, 2020)

In Part II, I will look at how the core module collects data from a victim’s device, how it extracts submodules, how it injects its injection-module into other processes, and other malicious behaviors.
[...]
From my analysis, we can safely say that the developer of QBot is super careful. QBot performs numerous checks (for example, with “/C, /W” parameters) before performing a malicious action. It also wipes its footprints from time to time to evade detection. All of the intermediate data is also encrypted, and files are deleted immediately after use.
Click to expand...

guest · Aug 27, 2020

Your email threads are now being hijacked by the QBot Trojan
Operators have changed their tactics in the quest for data theft
August 27, 2020
https://www.zdnet.com/article/your-email-threads-are-now-being-hijacked-by-qbot-trojan/

QBot Trojan operators are using new tactics to hijack legitimate, emailed conversations in order to steal credentials and financial data.

On Thursday, cybersecurity researchers from Check Point published research on the new trend, in which Microsoft Outlook users are susceptible to a module designed to collect and compromise email threads on infected machines.
Once a PC has been infected, a new and interesting module in the modern QBot variant described by Check Point as an "email collector module" extracts all email threads contained within an Outlook client and uploads them to the attacker's command-and-control (C2) server.
Click to expand...

A QBot malspam campaign launched this month, focused on US and European targets including government, military, and manufacturing entities.

"These days Qbot is much more dangerous than it was previously -- it has active malspam campaigns which infects organizations, and it manages to use a third-party infection infrastructure like Emotet's to spread the threat even further," the researchers say.
Click to expand...

Check Point Research: An Old Bot’s Nasty New Tricks: Exploring Qbot’s Latest Attack Methods

The notorious banking trojan Qbot has been in business for more than a decade. The malware, which has also been dubbed Qakbot and Pinkslipbot, was discovered in 2008 and is known for collecting browsing data and stealing banking credentials and other financial information from victims.

One of Qbot’s new tricks is particularly nasty, as once a machine is infected, it activates a special ‘email collector module’ which extracts all email threads from the victim’s Outlook client, and uploads it to a hardcoded remote server. These stolen emails are then utilized for future malspam campaigns, making it easier for users to be tricked into clicking on infected attachments because the spam email appears to continue an existing legitimate email conversation.
Click to expand...

This article analyzes two aspects of the threat – the campaign that leads to the infection of the victim, and the complex multi-layered malware which is constantly evolving. The article also covers several miscellaneous topics regarding its version history in the past year, decryption methods, communication samples, proxy server control API, and more.
Click to expand...

Minimalist · Oct 12, 2020

Qbot uses Windows Defender Antivirus attachment to infect computers

The Qbot botnet uses a new template for the distribution of their malware that uses a fake Windows Defender Antivirus theme to trick you into enabling Excel macros.
Click to expand...

https://www.bleepingcomputer.com/ne...der-antivirus-attachment-to-infect-computers/

guest · Dec 9, 2020

Qbot malware switched to stealthy new Windows autostart method
December 9, 2020
https://www.bleepingcomputer.com/ne...hed-to-stealthy-new-windows-autostart-method/

A new Qbot malware version now activates its persistence mechanism right before infected Windows devices shutdown and it automatically removes any traces when the system restarts or wakes up from sleep.

Qbot (also known as Qakbot, Quakbot, and Pinkslipbot) is a Windows banking trojan with worm features active since at least 2009 and used to steal banking credentials, personal information, and financial data.
Switching to a stealthier persistence mechanism
Starting with November 24, when Binary Defense threat researcher James Quinn says that the new Qbot version was spotted, the malware is using a newer and stealthier persistence mechanism that takes advantage of system shutdown and resume messages to toggle persistence on infected devices.
Click to expand...

This tactic is so successful that some researchers have previously thought that the Qbot trojan has removed this persistence mechanism altogether.

"While initial reports by other researchers had stated that the Run key persistence mechanism was removed in the new version of Qakbot, it has instead been added to a more stealthy and interesting persistence mechanism that listens for System Shutdown Messages, along with PowerBroadcast Suspend/Resume messages," Quinn explains.
The malware will only add the Run key before the system goes into sleep or shuts down but it will do it so close to it happening that "security products don’t have a chance to detect and report on the new run key."

Qbot will then try to delete the persistence key several times once it's launched again on system wake up or login.
Click to expand...

Installation and config changes
Qbot's installation technique has also been updated in this new version as it uses a new DLL architecture which combines the malware loader and the bot within a single DLL.
Qbot has also switched to a new in-registry encrypted config from the .dat configuration and log files previously stored on victims' compromised computers.
Click to expand...

Binary Defense: Qakbot Upgrades To Stealthier Persistence Method

On November 24, Binary Defense’s analysts detected a major version update to Qakbot’s loader and bot, combining the loader and bot into one file. Additionally, it changed several of Qakbot’s persistence mechanisms to make them more stealthy, while moving a lot of its logging to the registry.
Click to expand...

Minimalist · Sep 2, 2021

QakBot technical analysis

QakBot, also known as QBot, QuackBot and Pinkslipbot, is a banking Trojan that has existed for over a decade. It was found in the wild in 2007 and since then it has been continually maintained and developed.
Click to expand...

https://securelist.com/qakbot-technical-analysis/

Rasheed187 · Sep 4, 2021

Minimalist said: ↑

QakBot technical analysis

https://securelist.com/qakbot-technical-analysis/
Click to expand...

What I found most interesting is that QakBot needs to perform code injection in order to install the hooking module. This hooking module is used to perform web injects, record keyboard input and sniff on network traffic. However I'm not sure how other moules like the cookies and password grabber work, I wonder if it simply searches for files on disk? This stuff should be explained more clearly.

guest · Jul 18, 2022

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection
July 12, 2022

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection.

"Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel (XLM) 4.0 to trick victims into downloading malicious attachments that install Qakbot," Zscaler Threatlabz researchers Tarun Dewan and Aditya Sharma said.
Click to expand...

The shifting tactics adopted by the malware from XLM macros in early 2022 to .LNK files in May is seen as an attempt to counter Microsoft's plans to block Office macros by default in April 2022, a decision it has since temporarily rolled back.

In addition, further modifications include the use of PowerShell to download the DLL malware and a switch from regsvr32.exe to rundlll32.exe to load the payload, in what the researchers described as a "clear sign of Qakbot evolving to evade updated security practices and defenses."
Click to expand...

Zscaler: Rise in Qakbot attacks traced to evolving threat techniques

Active since 2008, Qakbot, also known as QBot, QuackBot and Pinkslipbot, is a common trojan malware designed to steal passwords. This pervasive threat spreads using an email-driven botnet that inserts replies in active email threads. Qakbot threat actors are also known to target bank customers and use the access they gain through compromised credentials to spy on financial operations and gain valuable intel.

Other more subtle techniques are being deployed by threat actors to prevent automated detection and raise the odds that their attack will work, including obfuscating code, leveraging multiple URLs to deliver the payload, using unknown file extension names to deliver the payload, and altering the steps of the process by introducing new layers between initial compromise, delivery, and final execution.
Click to expand...

guest · Jul 24, 2022

QBot phishing uses Windows Calculator sideloading to infect devices
July 24, 2022

The operators of the QBot malware have been using the Windows Calculator to side-load the malicious payload on infected computers.

DLL side-loading is a common attack method that takes advantage of how Dynamic Link Libraries (DLLs) are handled in Windows. It consists of spoofing a legitimate DLL and placing it in a folder from where the operating system loads it instead of the legitimate one.

QBot, also known as Qakbot is a Windows malware strain that started as a banking trojan but evolved into a malware dropper, and is used by ransomware gangs in the early stages of the attack to drop Cobalt Strike beacons.
Click to expand...

Security researcher ProxyLife recently discovered that Qakbot, has been abusing the the Windows 7 Calculator app for DLL side-loading attacks since at least July 11. The method continues to be used in malspam campaigns.
New QBot infection chain
To help defenders protect against this threat, ProxyLife and researchers at Cyble documented the latest QBot infection chain.
Click to expand...

It should be noted, that this DLL sideloading flaw no longer works in Windows 10 Calc.exe and later, which is why the threat actors bundle the Windows 7 version.
Click to expand...

Cyble: Qakbot Resurfaces With New Playbook

Threat Actors Leveraging DLL-SideLoading To Deliver Malware
During a routine threat-hunting exercise, Cyble Research Labs came across a Twitter post wherein a researcher shared new IoCs related to the infamous Qakbot malware.

For initial infection, Qakbot uses an email mass spamming campaign. The Qakbot Threat Actors (TAs) have continuously evolved their infection techniques ever since it was initially identified in the wild.
Click to expand...

In this campaign, the spam email contains a password-protected zip file which contains an ISO file. When mounted, this ISO file shows a .lnk file masquerading as a PDF file. If the victim opens the .lnk file, the system is infected with Qakbot malware. The figure below shows the Qakbot’s infection chain.
Conclusion
The TAs behind Qakbot are highly active and are continuously evolving their methods to increase their efficacy and impact.
Qakbot steals credentials from the victim’s system and uses them for the TA’s financial gain. Apart from the direct financial impact, this can also lead to incidences of fraud, identity theft, and other consequences for any victim of Qakbot malware.
Click to expand...

guest · Jul 31, 2022

Qakbot Attack Uses Email Threads Hijacked From ProxyLogon Compromises
July 29, 2022

Attackers are using hijacked email threads, harvested in bulk from previous Microsoft ProxyLogon attacks, in order to send messages to victims that deliver the Qakbot malware.

The campaign utilizes a known tactic that researchers with Cisco Talos call external thread hijacking. Attackers first compromise third-party Exchange servers and exfiltrate their email threads for later use. At a later date, they then use a script to process these aggregated emails at bulk into spoofed responses to email contacts the victim had previously corresponded with, with links to malicious URLs that lead to the deployment of Qakbot.

“After parsing the emails they then seek to weaponize them, but don’t have access to the actual Exchange server that sent the messages initially, just copies of the emails from the ones that received them,” said Nate Pors, senior incident response commander with Cisco Talos. “In this case, they spoofed the addresses to make them appear to come from the original recipient.”
Click to expand...

One red flag for spotting an external thread hijacking attack is if the email is from a spoofed, external sender address, even if the existing email thread looks familiar, said researchers. Another telltale sign is the use of old email threads that may be from 2021 or even 2020 (though Talos observed one email thread as recently as May 2022, indicating that attackers may be using newly harvested threads).

External thread hijacking shares similarities with email thread hijacking, where attackers use a single compromised organization’s emails to deliver their threat, as opposed to a bulk aggregation of multiple organizations’ harvested emails.
Click to expand...

Cisco Talos: What Talos Incident Response learned from a recent Qakbot attack hijacking old email threads

EXECUTIVE SUMMARY

In a recent malspam campaign delivering the Qakbot banking trojan, Cisco Talos Incident Response (CTIR) observed the adversary using aggregated, old email threads from multiple organizations that we assess were likely harvested during the 2021 ProxyLogon-related compromises targeting vulnerable Microsoft Exchange servers.

This campaign relies on external thread hijacking, whereby the adversary is likely using a bulk aggregation of multiple organizations’ harvested emails to launch focused phishing campaigns against previously uncompromised organizations. This differs from the more common approach to thread hijacking, in which attackers use a single compromised organization’s emails to deliver their threat.

This many-to-one approach is unique from what we have generally observed in the past and is likely an indirect effect of the widespread compromises and exfiltration of large volumes of email from 2020 and 2021.

Understanding the difference between external and single-victim thread hijacking is essential for detecting these threats. Below, we have several tips for defenders on how to identify key indicators of this activity.

Click to expand...

guest · Sep 2, 2022

June 2022 Qakbot Campaign
August 29, 2022

The eSentire Security Operations Center (SOC) has intercepted several incidents stemming from a recent Qakbot campaign. Qakbot is a malware-as-a-service (MaaS) known to precede ransomware intrusions associated with Maze, Egregor, and Conti ransomware groups. In a parallel analysis, eSentire’s Threat Response Unit (TRU) reports that the latest Qakbot campaigns are leading to Cobalt Strike infrastructure, which TRU tracks as INF5.
June 2022 Qakbot Campaign
A Qakbot campaign has been observed affecting industries and sectors across the board, including Government, Financial Services, Legal, Manufacturing, and Education. Qakbot campaigns originate from malicious email spam campaigns that are highly opportunistic in nature. At least one of the spam campaigns delivering Qakbot is attributed to TA570, recently observed attempting to exploit the Follina vulnerability via Qakbot.
Click to expand...

Qakbot has been observed:

Exfiltrating email inboxes, likely to be used later in email replay attacks and email usage analysis.

Stealing passwords and machine fingerprints from web browsers, which can be replicated in attacks leveraging valid credentials later.

Loading Cobalt Strike for ransomware intrusions.

In the recent June 2022 campaign, TRU and others have observed Qakbot occasionally dropping Cobalt Strike as before.
Click to expand...

guest · Sep 6, 2022

Surge of QakBot Activity Using Malspam, Malicious XLSB Files
September 6, 2022

The Multi-State Information Sharing and Analysis Center (MS-ISAC) is observing an uptick in U.S. State, Local, Tribal, and Territorial (SLTT) QakBot activity aligned with open-source reporting. This includes the research project abuse.ch, which found that 74% of the malware payloads received in April 2022 were for QakBot.
Click to expand...

What Is QakBot?
QakBot is a banking trojan that the cybersecurity community has tracked since 2007. Over time, it evolved into the modular malware that's currently being deployed. It has numerous capabilities and can perform enumeration (through net, whoami, nslookup, netstat, ipconfig, etc.), move laterally on a network through Server Message Block protocol (SMB), use keylogging capabilities to steal user credentials, monitor network traffic, and drop additional malware. More specifically, it monitors traffic to online banking websites and leverages a Man-in-the-Middle (MitM) technique to intercept authentication tokens on a user’s active banking session.
Click to expand...

Inside One QakBot Infection
The initial infection vector for all QakBot activity reported to the MS-ISAC was malspam; the attachments were either malicious XLSB file attachments or a password-protected ZIP file containing a malicious IMG, MSI, or XLSB file. Once executed, the malware reached out to malicious domains to download DLLs and create a new directory in the C: drive. The DLLs executed via regsvr32.exe. In some of the cases, the malware injected these DLLs into explorer.exe or onedrivesetup.exe. To establish persistence, QakBot created scheduled tasks via schtasks.exe.
Click to expand...

guest · Nov 17, 2022

QBot phishing abuses Windows Control Panel EXE to infect devices
By Lawrence Abrams @LawrenceAbrams - November 17, 2022

Phishing emails distributing the QBot malware are using a DLL hijacking flaw in the Windows 10 Control Panel to infect computers, likely as an attempt to evade detection by security software.
Click to expand...

In July, security researcher ProxyLife discovered that threat actors were exploiting a DLL hijacking vulnerability in the Windows 7 Calculator to install the QBot malware.

This week, ProxyLife told BleepingComputer that attackers have switched to using a DLL hijacking flaw in the Windows 10 Control Panel executable, control.exe.
Abusing the Windows Control Panel
In a phishing campaign seen by ProxyLife, the threat actors use stolen reply-chain emails to distribute an HTML file attachment that downloads a password-protected ZIP archive with an ISO file inside.
Click to expand...

This ZIP archive contains an ISO disk image that, when double-clicked, will automatically open in a new drive letter in Windows 10 and later.

This ISO file contains a Windows Shortcut (.LNK) file, a ‘control.exe’ (Windows 10 Control Panel) executable, and two DLL files named edputil.dll (used for DLL hijack) and msoffice32.dll (QBot malware).
Click to expand...

guest · Nov 25, 2022

An aggressive malware campaign targets US-based companies with Qakbot to deliver Black Basta Ransomware
By Pierluigi Paganini - November 24, 2022

Experts at the Cybereason Global SOC (GSOC) team have observed a surge in Qakbot infections as part of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US.
Click to expand...

In the last two weeks, the experts observed attacks against more than 10 different US-based customers.

“In this latest campaign, the Black Basta ransomware gang is using QakBot malware to create an initial point of entry and move laterally within an organization’s network. QakBot, also known as QBot or Pinkslipbot, is a banking trojan primarily used to steal victims’ financial data, including browser information, keystrokes, and credentials.” reads the report published by Cybereason.
“Once QakBot has successfully infected an environment, the malware installs a backdoor allowing the threat actor to drop additional malware—namely, ransomware.”
The attack chain starts with a QBot infection, The operators use the post-exploitation tool Cobalt Strike to take over the machine and finally deploy the Black Basta ransomware. The attacks began with a spam/phishing email containing malicious URL links.
Click to expand...

The researchers noticed that once obtained access to the network, the threat actor moves extremely fast. In some cases observed by Cybereason, the threat actor obtained domain administrator privileges in less than two hours and moved to ransomware deployment in less than 12 hours.
Click to expand...

Cybereason: THREAT ALERT: Aggressive Qakbot Campaign and the Black Basta Ransomware Group Targeting U.S. Companies

November 23, 2022
The Cybereason Global SOC (GSOC) team is investigating Qakbot infections observed in customer environments related to a potentially widespread ransomware campaign run by Black Basta. The campaign is primarily targeting U.S.-based companies.

Black Basta is a ransomware group that emerged in April 2022 and specifically targets organizations in the United States, Canada, United Kingdom, Australia, and New Zealand. The group is known for using double-extortion tactics: they steal sensitive files and information from victims and later use it to extort victims by threatening to publish the data unless the victim pays the ransom.
Click to expand...

guest · Feb 7, 2023

New QakNote attacks push QBot malware via Microsoft OneNote files
By Bill Toulas @billtoulas - February 7, 2023

A new QBot malware campaign dubbed "QakNote" has been observed in the wild since last week, using malicious Microsoft OneNote' .one' attachments to infect systems with the banking trojan.
Click to expand...

Qbot (aka QakBot) is a former banking trojan that evolved into malware that specializes in gaining initial access to devices, enabling threat actors to load additional malware on the compromised machines and perform data-stealing, ransomware, or other activities across an entire network.

OneNote attachments in phishing emails emerged last month as a new attack vector to replace malicious macros in Office documents that Microsoft disabled in July 2022, leaving threat actors with fewer options to execute code on targets' devices.
Click to expand...

The QakNote campaign
In the new report by Sophos, security researcher Andrew Brandt explains that QBot's operators have started experimenting with this new distribution method since January 31, 2023, using OneNote files that contain an embedded HTML application (HTA file) that retrieves the QBot malware payload.

This switch in QBot's distribution was first publicly reported by Cynet's researcher Max Malyutin on Twitter on January 31, 2023.
The QBot payload injects itself into the Windows Assistive Technology manager (“AtBroker.exe”) to conceal its presence and evade detection from AV tools running on the device.
Click to expand...

Sophos reports that QBot’s operators employ two distribution methods for these HTA files: one that sends emails with an embedded link to the weaponized .one file and one where the “thread injections” method is used.

To make these attacks even more deceptive for the victims, the threat actors use a fake button in the Notebook file that supposedly downloads the document from the cloud, but if clicked, it instead runs the embedded HTA attachment.
Click to expand...

Sophos: Qakbot mechanizes distribution of malicious OneNote notebooks

by Andrew Brandt - February 6, 2023
A large-scale "QakNote" attack deploys malicious .one files as a novel infection vector
Since the beginning of the year, we’ve been tracking the growth of malware threat actors taking advantage of a (previously) rarely abused Office file format – the .one files used by the OneNote application. So have a few other security companies.

Our initial look at this threat vector revealed a number of small-scale malware attacks, but now a more prominent malware group — Qakbot — has begun using the method in their campaigns in a much more automated, streamlined fashion.
Click to expand...

Log in or Sign up

Qakbot (Qbot) — This password-stealing malware just evolved a new tactic to remain hidden

guest Guest

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

roger_m Registered Member

Sampei Nihira Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Qakbot (Qbot) — This password-stealing malware just evolved a new tactic to remain hidden

guest Guest

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

roger_m Registered Member

Sampei Nihira Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches