Whereas the Qakbot banking Trojan was eradicated in August by a large-scale regulation enforcement operation, the individuals behind it are nonetheless energetic and pose a risk to customers, researchers stated at present.
In accordance with a report from Cisco’s Talos risk intelligence group, its consultants can say with “reasonable confidence” that the creators and operators of Qakbot are actively engaged on a brand new marketing campaign, this time distributing a variant of the Knight malware, which rebranded from Cyclops in July. Knight is a ransomware risk that operates as a service, distributed by phishing and extorting cash from victimized corporations by threatening to promote exfiltrated information.
The Talos workforce primarily based their evaluation on figuring out drive serial numbers in LNK, or Home windows shortcut, file metadata from computer systems related to the sooner Qakbot assaults. Regardless of the Qakbot actors’ makes an attempt to scrub metadata from the particular information utilized by Talos, the workforce was nonetheless apparently capable of establish one machine as being linked to these assaults.
“A number of the filenames are written in Italian, which suggests the risk actors could also be concentrating on customers in that area,” the Talos weblog stated. “The LNK information are being distributed inside Zip archives that additionally comprise an XLL file.”
XLL information, the group famous, are a Microsoft Excel-related file format extension, which seem just like common .xls information in an Explorer window. The XLL information, if opened, set up the Remcos backdoor, which is a distant administration instrument that works in live performance with Knight malware to achieve entry to focused techniques.
Talos stated that the Qakbot actors are unlikely to be the masterminds behind the Knight ransomware service itself, and are as a substitute in all probability prospects. The FBI-led enforcement motion that took down Qakbot’s command-and-control servers in August, due to this fact, doubtless did not have an effect on the group’s phishing infrastructure. This may occasionally additionally permit the group to easily rebuild its personal back-end techniques for Qakbot, resulting in a possible resurgence.
