Whereas the Qakbot banking Trojan was eradicated in August by a large-scale regulation enforcement operation, the folks behind it are nonetheless lively and pose a risk to customers, researchers stated right now.
In response to a report from Cisco’s Talos risk intelligence group, its specialists can say with “reasonable confidence” that the creators and operators of Qakbot are actively engaged on a brand new marketing campaign, this time distributing a variant of the Knight malware, which rebranded from Cyclops in July. Knight is a ransomware risk that operates as a service, distributed by phishing and extorting cash from victimized corporations by threatening to promote exfiltrated information.
The Talos workforce primarily based their evaluation on figuring out drive serial numbers in LNK, or Home windows shortcut, file metadata from computer systems related to the sooner Qakbot assaults. Regardless of the Qakbot actors’ makes an attempt to scrub metadata from the precise recordsdata utilized by Talos, the workforce was nonetheless apparently capable of establish one machine as being linked to these assaults.
“Among the filenames are written in Italian, which suggests the risk actors could also be concentrating on customers in that area,” the Talos weblog stated. “The LNK recordsdata are being distributed inside Zip archives that additionally comprise an XLL file.”
XLL recordsdata, the group famous, are a Microsoft Excel-related file format extension, which seem just like common .xls recordsdata in an Explorer window. The XLL recordsdata, if opened, set up the Remcos backdoor, which is a distant administration device that works in live performance with Knight malware to achieve entry to focused techniques.
Talos stated that the Qakbot actors are unlikely to be the masterminds behind the Knight ransomware service itself, and are as a substitute most likely clients. The FBI-led enforcement motion that took down Qakbot’s command-and-control servers in August, subsequently, possible did not have an effect on the group’s phishing infrastructure. This will likely additionally permit the group to easily rebuild its personal back-end techniques for Qakbot, resulting in a possible resurgence.
