QakBot Malware Resurfaces, Targets Hospitality Industry

QakBot malware reappears post law enforcement takedown.

Low-volume phishing campaign started targeting hospitality on Dec 11, 2023.

[{"selector":"#anim-a7672ddc-3d4a-44c3-8959-a02a3a14ae8f","keyframes":{"transform":["rotate(-341deg) translate3d(85.02081%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-e319235d-b9cc-42b7-b84d-444920d3ce90","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-87f28907-99c8-49be-be09-f1cfc7723da1","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-107630de-4403-4f65-a711-078556e5f2b4","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bc76d7c1-8da8-40ec-adda-9e51f2d97ea3","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Attack involves a PDF from a fake IRS employee with a malicious URL.

[{"selector":"#anim-ac719c46-8c4d-4cb2-a342-d031f543aabb","keyframes":{"transform":["rotate(-341deg) translate3d(84.74341%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-4e29e318-abfc-4860-ba21-81b602ed11c8","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-e4f9e658-cdd8-4f47-b171-da3957a4d430","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e751f306-5027-4d19-9d52-2b08733f23dc","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-64b7cec0-a880-4de4-bec0-203c03b11551","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

URL downloads a digitally signed Windows Installer (.msi) leading to QakBot execution

[{"selector":"#anim-98780785-9c67-42b5-b7c9-8fc6e73b952d","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-d4d5a4eb-a8db-46c4-9b72-be7d3bf0ee9b","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-40c2094e-f461-42ff-bd06-f9c1bf908749","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-eec90624-12b3-4415-8360-c321c2b4fc3d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5148acab-95aa-4e17-9d05-3b6f08aa57f1","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

QakBot payload configured with a new version, 0x500, not seen before.

[{"selector":"#anim-fa72b3c4-2072-48b9-b623-13aec9b562eb","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-d3329206-af7b-4903-8ab9-34ee7d1d8178","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-5b9a35f3-3c83-4e5d-9cd2-7aa022f4554f","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5c4e8133-ae2a-495b-b0b7-f52114b8f90c","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8a186a32-f5e1-41c3-b645-d02d26bb2407","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Resurfaced QakBot is a 64-bit binary using AES for network encryption.

[{"selector":"#anim-e318dd47-d99c-4d0a-8710-f9ca2c0dacd4","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-97c2043b-cf72-4396-b347-cbf85a7e7be5","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-f2633771-3be5-476a-a4d0-cc036b9fc50f","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-018bf63c-662c-4714-91b3-6a5cede916d6","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-621c8975-952a-444d-beca-c46ba9d89c97","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Sends POST requests to the path /teorema505.

[{"selector":"#anim-2d447eb2-4091-4f29-b563-2b7454367cec","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-3f2f5c17-ea63-4ea9-8754-8e2b074434c4","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-f2957140-f92f-460e-b43a-5db8578471dd","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-82ca5301-ee36-4ec8-b799-d5159cc4376b","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2a61b0a5-7bdc-4ecd-a9fb-02640bca0f7f","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

QakBot traditionally distributed via spam emails, capable of data harvesting.

[{"selector":"#anim-9d0a1bb9-fadf-445d-864b-98182676c8cc","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-038ef5c3-808e-42d6-98b0-584a2a56b82d","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-32551d50-a5e5-4410-93e7-c7f42a8fe987","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b1f748ce-197d-4277-b639-3d11859d190e","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2d989876-c8c5-4a21-a44b-0b3a783b0189","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Similar to Emotet, QakBot's return emphasizes the resilience of such threats.

[{"selector":"#anim-09dfcbd7-a79c-4db9-b43d-6915679593fc","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-e1ae4de7-17d0-4673-b9d5-bc36520a7549","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-f024610d-6e64-4028-9949-4f47c8a5b902","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-db1c41c0-521d-449e-8c52-64e1b067ab19","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0ed7618c-ed57-4efc-88c2-01094d9558f3","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Organizations urged to be cautious against spam emails associated with QakBot.

[{"selector":"#anim-69dce344-2c66-4a56-95b4-d10046bc4c1e","keyframes":{"transform":["rotate(-341deg) translate3d(83.77254%, 0px, 0) rotate(341deg)","rotate(-341deg) translate3d(0px, 0px, 0) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-26bed31b-1be7-4555-95ee-5f2ec8223157","keyframes":{"transform":["rotate(-341deg) rotateZ(180deg) rotate(341deg)","rotate(-341deg) rotateZ(0deg) rotate(341deg)"]},"delay":0,"duration":500,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-a13d932e-a334-4cbb-9cd0-3709f6da4cad","keyframes":{"transform":["translate3d(-115.18988%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ace2486d-251a-4c8c-887f-95478fc15ec2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1b9657bb-3cf1-43a3-b884-35b4eef24489","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]