Matthew Mesa

Tweets are my own.

[Matthew Mesa @mesa_matt]

The adventures of Josephine Pena. From LinkedIn invitations to More_eggs Jscript Downloader:
https://t.co/xuhAbbT1f6

[Virus Bulletin @virusbtn]

Zscaler's Nikolaos Pantazopoulos analyses the functionality of Raspberry Robin (also known as Roshtyak), including its execution layers, obfuscation methods and network communication process, along with its latest exploits. https://t.co/IUxXDM5Loy

[waymon @obnoxious4n6]

https://t.co/oqd15GHNBk

[Matthew Mesa @mesa_matt]

And of course the earlier Rapid7 blogpost covering the Quick Assist abuse they observed:
https://t.co/LMbNiYxIRS

[Matthew Mesa @mesa_matt]

Related:
https://t.co/fxhsdcVG5Y

Qakbot and other payloads delivered via ☎, Quick Assist, and social engineering. Leading to 🍝. Also with tie ins to:
https://t.co/yhRc35AN6U

[Microsoft Threat Intelligence @MsftSecIntel]

Since mid-April 2024, Microsoft Threat Intelligence has observed the threat actor Storm-1811 misusing the client management tool Quick Assist to target users in social engineering attacks that lead to Black Basta ransomware. https://t.co/PA5dW6alnQ

[Matthew Mesa @mesa_matt]

@bryceabdo 🍝

[waymon @obnoxious4n6]

I’ll be speaking @SLEUTHCON this year!

The lineup is amazing. I can’t wait to learn from everyone.

Full list of speakers here: https://t.co/JgghOZJYy4

[Matthew Mesa @mesa_matt]

Continuation of the campaign IDs first seen here:
https://t.co/vjXAlWdXH0

[Microsoft Threat Intelligence @MsftSecIntel]

An embedded configuration EPOCH timestamp indicates the payload was generated on December 11. The campaign code was tchk06. Most notably, the delivered Qakbot payload was configured with the previously unseen version 0x500.
Observed Qakbot C2:
45[.]138.74.191
65[.]108.218.24

[Matthew Mesa @mesa_matt]

Be alert that there is Qakbot being spread in the wild:
49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0

Campaign: tchk08

ITW URLs on Virustotal:
upd5[.]pro
upd112.appspot[.]com

[William Metcalf @node5]

Join me, @switchingtoguns, @a_de_pasquale, and our team as a Sr. Threat Researcher focusing on phishing detection. Use your skills in pattern-based detection, regex, HTML/HTTP, and current phishing landscape, to combat phishing threats for SAA customers
https://t.co/BaD7lLjC4I

[Matthew Mesa @mesa_matt]

@wdormann @ItsReallyNick It was disabled then. It was re-enabled by default in later versions - the versions are listed in the MSRC blog.

[Myrtus @Myrtus0x0]

Ya Qbot is back, it sucks. But look what happened with Emotet when it came back. Was a half assed attempt at running a botnet which eventually disappeared without any LE. Lets make it so that becomes the case with Qbot as well.

[Tommy M (TheAnalyst) @ffforward]

Can confirm that we have seen the recent #Qbot #Quakbot #Qakbot activity. PDFs/URLs has been used since at least November 28, but can't confirm what payload it was earlier than December 11.
URL example: https://t.co/vqlLJ1NoVj
MSI/DLL: https://t.co/0Gd5s8R3io

[Microsoft Threat Intelligence @MsftSecIntel]

An embedded configuration EPOCH timestamp indicates the payload was generated on December 11. The campaign code was tchk06. Most notably, the delivered Qakbot payload was configured with the previously unseen version 0x500.
Observed Qakbot C2:
45[.]138.74.191
65[.]108.218.24

[Matthew Mesa @mesa_matt]

Unfortunately, I had to look at their email campaigns again this week.

[Matthew Mesa @mesa_matt]

RIP Qbot. After having to look at Qbot email campaigns on a regular basis since ~2017, I don't think I'll miss it.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.

[Sean Farrell @spfcyberlaw]

So proud to be a part of this collective effort at Microsoft. Badasses at Microsoft Threat Intelligence supporting significant Digital Crimes Unit legal disruptions. This is just the beginning, so many more targets, so much more we are doing and will do #staytuned

[Joe Hannon @JoeHannon52]

Would you realise if java.exe spawning something dodgy was a 0-day? @0g_omkar and team did, patch your on-prem SysAid instances

[sysopfb @sysopfb]

Coworker of mine on his first solo blog post! #smartapesg https://t.co/oETZ6s0uvi

[Matthew Mesa @mesa_matt]

@bryceabdo 🦀🆙🍝🆙

[Hash Miser @H_Miser]

Malware delivered via teams, you should have a look at this. No log, no protection, except if you configure team to only allow trusted orgs to discuss with yours. But you can’t see if it’s already in use because you don’t have logs…

https://t.co/uTDHF7PCgB