Dec 18, 2023, 03:38 PM
A fresh batch of phishing messages has been detected, spreading the QakBot malware.
https://encrypted-tbn0.gstatic.com/image...p;usqp=CAU
This comes after law enforcement successfully dismantled its command-and-control (C2) network a few months ago.
Microsoft discovered this low-volume campaign, which started on December 11, 2023, and specifically targeted the hospitality industry.
The targets received a PDF from someone pretending to be an IRS employee.
Inside the PDF, there was a URL that downloaded a digitally signed Windows Installer (.msi) file.
Running the MSI file triggered the activation of QakBot through the execution of an embedded DLL using the 'hvsi' export.
Microsoft stated that the payload was created on the same day the campaign began and it is set up with a version 0x500 that has not been seen before.
QakBot, also known as QBot and Pinkslipbot, was stopped during Operation Duck Hunt when authorities accessed its infrastructure and directed infected computers to download an uninstaller file, rendering the malware useless.
https://encrypted-tbn0.gstatic.com/image...p;usqp=CAU
This comes after law enforcement successfully dismantled its command-and-control (C2) network a few months ago.
Microsoft discovered this low-volume campaign, which started on December 11, 2023, and specifically targeted the hospitality industry.
The targets received a PDF from someone pretending to be an IRS employee.
Inside the PDF, there was a URL that downloaded a digitally signed Windows Installer (.msi) file.
Running the MSI file triggered the activation of QakBot through the execution of an embedded DLL using the 'hvsi' export.
Microsoft stated that the payload was created on the same day the campaign began and it is set up with a version 0x500 that has not been seen before.
QakBot, also known as QBot and Pinkslipbot, was stopped during Operation Duck Hunt when authorities accessed its infrastructure and directed infected computers to download an uninstaller file, rendering the malware useless.