#Qakbot threat actors are on fire 🔥 recently. We observed a high volume of attacks both internally and through external sources. Here is a brief summary of their current attack chain. 🧵1/6
Qakbot's main initial access vector is still through malspam campaigns ✉️. They use email thread hijacking for their spam messages to increase the likelihood that the victim user will interact on the message. 🧵2/6 
After a short excursion to OneNote files, both main active #Qakbot botnets have currently returned to using HTML smuggling to deliver the initial attack payload. This technique has already been seen in many campaigns last year. 🧵3/6
The obama botnet currently uses a fake Onedrive message to lure victims into opening the enclosed payload, which is embedded as a base64-encoded string. The BB botnet instead uses Latin-themed texts and contains a script that will download the payload from a remote server. 🧵4/6
In both cases, the next stage is a JavaScript file. If opened with wscript, it triggers download and execution of the #Qakbot malware ⚠️. System administrators should consider changing the default application for .js files (and similar scripts) to prevent such attacks. 🧵5/6
#Qakbot remains to be one of the most dangerous initial access brokers and is a key ransomware enabler. Deutsche Telekom CERT and CTI will keep monitoring 🔍 the evolution of Qakbot's TTPs. 🧵6/6
• • •
Missing some Tweet in this thread? You can try to
force a refresh
