Zscaler's Nikolaos Pantazopoulos analyses the functionality of Raspberry Robin (also known as Roshtyak), including its execution layers, obfuscation methods and network communication process, along with its latest exploits. https://t.co/IUxXDM5Loy
Related:
https://t.co/fxhsdcVG5Y
Qakbot and other payloads delivered via ☎, Quick Assist, and social engineering. Leading to 🍝. Also with tie ins to:
https://t.co/yhRc35AN6U
Since mid-April 2024, Microsoft Threat Intelligence has observed the threat actor Storm-1811 misusing the client management tool Quick Assist to target users in social engineering attacks that lead to Black Basta ransomware. https://t.co/PA5dW6alnQ
An embedded configuration EPOCH timestamp indicates the payload was generated on December 11. The campaign code was tchk06. Most notably, the delivered Qakbot payload was configured with the previously unseen version 0x500.
Observed Qakbot C2:
45[.]138.74.191
65[.]108.218.24
Be alert that there is Qakbot being spread in the wild:
49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0
Campaign: tchk08
ITW URLs on Virustotal:
upd5[.]pro
upd112.appspot[.]com
Join me, @switchingtoguns, @a_de_pasquale, and our team as a Sr. Threat Researcher focusing on phishing detection. Use your skills in pattern-based detection, regex, HTML/HTTP, and current phishing landscape, to combat phishing threats for SAA customers
https://t.co/BaD7lLjC4I
Ya Qbot is back, it sucks. But look what happened with Emotet when it came back. Was a half assed attempt at running a botnet which eventually disappeared without any LE. Lets make it so that becomes the case with Qbot as well.
Can confirm that we have seen the recent #Qbot#Quakbot#Qakbot activity. PDFs/URLs has been used since at least November 28, but can't confirm what payload it was earlier than December 11.
URL example: https://t.co/vqlLJ1NoVj
MSI/DLL: https://t.co/0Gd5s8R3io
An embedded configuration EPOCH timestamp indicates the payload was generated on December 11. The campaign code was tchk06. Most notably, the delivered Qakbot payload was configured with the previously unseen version 0x500.
Observed Qakbot C2:
45[.]138.74.191
65[.]108.218.24
Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.
So proud to be a part of this collective effort at Microsoft. Badasses at Microsoft Threat Intelligence supporting significant Digital Crimes Unit legal disruptions. This is just the beginning, so many more targets, so much more we are doing and will do #staytuned
Malware delivered via teams, you should have a look at this. No log, no protection, except if you configure team to only allow trusted orgs to discuss with yours. But you can’t see if it’s already in use because you don’t have logs…
https://t.co/uTDHF7PCgB