15 Years of Qakbot

Qakbot, also known as Qbot or Pinkslipbot, is a form of malware that primarily targets Windows-based systems. Initially observed around 2007, Qakbot has evolved over time into a sophisticated and formidable threat. Its capabilities have expanded from a banking Trojan focused on stealing financial data to a multifaceted malware that delivers ransomware, exfiltrates data, and provides backdoor access to compromised systems. This article delves into the intricacies of Qakbot, its operational tactics, the threat it poses to organizations, and the strategies to mitigate this risk.

Qakbot Threat Still Lingering Despite FBI Takedown

In October 2023, security researchers issued a stark warning: the Qakbot-affiliated hackers, despite a high-profile FBI takedown in August, are still actively posing a significant threat. The FBI's "Operation Duck Hunt" disrupted Qakbot's infrastructure, but it seems the group quickly adapted.

DOCUMENTS AND RESOURCES RELATED TO THE DISRUPTION OF THE QAKBOT MALWARE AND BOTNET

DOJ USAO Logo Central District of California

Key Findings:

1. Qakbot hackers continued their operations with a ransomware campaign.
2. They employed the Cyclops/Ransom Knight ransomware and the Remcos backdoor malware.
3. The FBI operation affected command and control servers but not email delivery infrastructure.
4. Phishing emails with urgent financial themes, some in Italian, have been used to distribute malware.
5. LNK files have been used for tracking the threat actors' activities.

The persistence of threats like Qakbot raises questions about the long-term effectiveness of law enforcement takedowns. Past experiences with Trickbot and Emotet show that these groups often re-emerge.

FBI makes a massive botnet infecting more than 700,000 computers uninstall itself

The FBI led the effort to dismantle Qakbot.

The Verge

Understanding the Impact of Ransomware Attacks: Three Prison Cases

Case of Conor Brian Fitzpatrick and BreachForums Russian TrickBot Malware Developer Sentenced to Prison in US The Case of Matthew Philbert Ransomware attacks pose significant threats to businesses and government entities, disrupting operations and compromising sensitive data. The recent sentencing of Matthew Philbert highlights the severity of such cybercrimes. Despite

Breached CompanyBreached Company

Stay vigilant and ensure robust cybersecurity measures to protect against evolving threats.

Qakbot threat still lingering despite FBI takedown

Qakbot-affiliated threat actors are still active despite the high-profile takedown

IT ProRoss Kelly

August 29,2023 FBI Says they crippled Qakbot Infrastructure:

• 00:00 🌐 FBI Director Christopher Wray Announces Botnet Takedown
  • FBI led a worldwide operation to cripple a long-running botnet.
  • Various victims, including financial institutions, a government contractor, and a medical device manufacturer, were affected.
  • Ransomware actors and cybercriminals used the botnet for attacks and data theft.
• 01:05 💻 Botnet Impact and FBI Intervention
  • The botnet infected 700,000 computers, causing attacks on individuals and businesses globally.
  • Notable ransomware groups like Conti and ProLock utilized the botnet.
  • FBI's operation infiltrated and dismantled the botnet, seizing cryptocurrency in the process.
• 02:09 🔐 Collaborative Efforts and Cyber Threats
  • Acknowledgment of FBI Los Angeles, Cyber Division, and partners' contributions.
  • Emphasis on the growing complexity of cyber threats.
  • Assurance of the FBI's commitment to fighting cybercrime and promoting digital security.

Qakbot is a type of malware known for its resilience, modularity, and ability to evade detection. It's primarily distributed through phishing emails and compromised websites. Once it infiltrates a system, Qakbot can propagate across networks, leading to widespread damage. Over the years, Qakbot has been updated by its creators to include various functionalities, making it a versatile tool for cybercriminals.

New QakBot phishing campaign appears, months after FBI takedown

After authorities dismantled the formidable botnet in August, a new QakBot campaign targeting the hospitality sector has surfaced.

SC MediaSimon Hendery

Operational Tactics of Qakbot

1. Initial Infiltration: Qakbot often gains entry into systems through phishing emails containing malicious attachments or links. These emails are typically crafted to appear legitimate, enticing unsuspecting users to initiate the infection process.
2. Lateral Movement: After establishing a foothold on a single system, Qakbot uses various techniques, including exploitation of vulnerabilities and credential dumping, to spread across the network.
3. Persistence Mechanisms: Qakbot is known for its persistence; it employs multiple techniques to ensure it remains active on infected systems even after reboots or attempts to remove it.
4. Data Exfiltration: Qakbot can harvest a wide range of sensitive data, including banking credentials, financial information, and personal identification details. This data is then transmitted to command-and-control (C2) servers operated by attackers.
5. Modularity and Updates: Qakbot receives regular updates from its C2 servers, allowing it to load additional modules for specific tasks, adapt to changing security environments, and repair itself if parts are removed or damaged.
6. Delivery of Secondary Payloads: Besides its primary functionality, Qakbot can also deliver additional malware, including ransomware, to compromised systems, further exacerbating the impact of an attack.

Threats Posed by Qakbot

Qakbot poses several threats to individuals and organizations:

1. Financial Loss: By stealing banking credentials and financial information, Qakbot can facilitate unauthorized transactions, leading to direct financial loss.
2. Data Breach: The exfiltration of sensitive data can result in significant privacy violations and regulatory repercussions, especially for organizations bound by data protection regulations.
3. System Compromise: Qakbot's ability to provide attackers with backdoor access to systems can lead to widespread network compromise and operational disruption.
4. Secondary Attacks: The deployment of secondary payloads like ransomware can lead to data loss, reputational damage, and substantial recovery costs.

Qakbot, also known as QBot or Pinkslipbot, has been a persistent and evolving threat in the cybersecurity landscape for over 15 years. Originally designed as a banking trojan, it has transformed into a sophisticated malware implant capable of various malicious activities, including facilitating ransomware attacks. This blog post delves into the extensive history of Qakbot, highlighting its development and adaptation, and sheds light on the resilience and innovation of the threat actors behind it.

Key Takeaways

Here are some key takeaways from our analysis of Qakbot's evolution:

1. Origin as a Banking Trojan: Qakbot emerged in 2008 as a banking trojan with the primary goal of stealing credentials and engaging in fraudulent financial activities.
2. Transition to Initial Access Broker: In recent years, Qakbot has shifted its focus, becoming an initial access broker that delivers tools like Cobalt Strike for lateral movement and facilitates second-stage infections, including ransomware like BlackBasta.
3. Anti-Analysis Techniques: Qakbot has continuously improved its anti-analysis techniques to evade malware sandboxes, antivirus software, and other security products. This includes string obfuscation, API obfuscation, and the use of junk code to thwart static antivirus signatures.
4. Modular Structure: Qakbot's modular structure allows it to download plugins dynamically, enabling the addition of new functionalities without the need for a new version release.
5. Longevity and Innovation: The threat group behind Qakbot has released five distinct versions of the malware, with the latest update in December 2023. This longevity and adaptability showcase the persistence and innovation of the threat actors.

A closer look at Qakbot’s latest building blocks (and how to knock them down) | Microsoft Security Blog

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan, Qakbot has evolved into a multi-purpose […]

Microsoft Security BlogMicrosoft Threat Intelligence

A Brief History of Qakbot

Early Versions (1.0.0 and 2.0.0)

The earliest versions of Qakbot date back to 2008 and were marked by a simple XOR-based string obfuscation technique. These versions leveraged a dropper with malicious DLLs for various functions, including stealing passwords and spreading via SMB. They even had a feature to report crash dumps, indicating their early development.

Transition to Initial Access Broker

Qakbot primarily focused on banking fraud until 2019 when it transitioned into an initial access broker for ransomware attacks, cooperating with threat groups like Conti, ProLock, Egregor, REvil, MegaCortex, and BlackBasta.

Evolving Anti-Analysis Techniques

Qakbot consistently improved its anti-analysis techniques. It obfuscated strings using XOR algorithms, used API obfuscation by resolving imports dynamically, and introduced junk code to evade static antivirus signatures.

Anti-Sandbox Techniques

Qakbot incorporated multiple detection mechanisms to identify researcher environments and malware sandboxes. It checked system artifacts, virtual machine information, and processes associated with analysis environments to identify potential threats.

Network Communication

Protocol and Encryption

Qakbot has evolved its network communication over the years. It started with a simple HTTP-based protocol and moved to a JSON-based message format. Encryption methods have also advanced from RC4 to AES, with SHA1 and SHA256 for key derivation.

Domain Generation Algorithm

Initially, Qakbot used hardcoded C2 servers, but later versions added a domain generation algorithm (DGA) to generate backup C2 domains dynamically. Some versions even generated fake domains to mislead researchers.

Data Exfiltration and Relay

Early versions of Qakbot used compromised FTP servers for data exfiltration, but this changed to direct communication with the C2 infrastructure in later versions. Compromised systems were employed as relay servers, reducing the risk of exposure.

Modular Structure

Qakbot's design has become more modular over time. It utilizes a lightweight stager for initialization and persistence, downloading additional modules from C2 servers to enhance functionality on-demand.

Embedded Resources

Earlier versions stored configuration information and malicious DLLs in the resource section, with various encryption algorithms to protect them. More recent versions used RC4-based encryption and compression.

Plugins

Qakbot's modular approach allows it to download plugins dynamically, expanding its capabilities. These plugins enable activities like web browser manipulation, email theft, and deployment of Cobalt Strike.

Despite significant disruptions to Qakbot's infrastructure in August 2023, the threat group behind it remains active and innovative. Recent updates include support for 64-bit Windows, enhanced encryption algorithms, and increased obfuscation. This resilience suggests that Qakbot will continue to pose a threat in the foreseeable future, emphasizing the importance of ongoing detection and protection efforts.

In the ever-evolving landscape of cybersecurity, understanding the history and tactics of malware like Qakbot is crucial for staying ahead of cyber threats and safeguarding digital environments.

Key Takeaway

The joint Cybersecurity Advisory by CISA and FBI provides information on the identification and disruption of QakBot infrastructure, including indicators of compromise (IOCs) and mitigation recommendations to prevent QakBot-related activity.

Summary

• The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA) to share QakBot infrastructure indicators of compromise (IOCs) identified in August 2023.
• A coordinated operation on August 25 disrupted QakBot infrastructure globally, resulting in the takeover of the botnet and the severing of the connection between victim computers and QakBot command and control (C2) servers.
• CISA and FBI are collaborating with industry partners to maximize detection, remediation, and prevention of QakBot-related threats.
• Recommendations for organizations include implementing security measures to reduce the likelihood of QakBot-related activity and identifying QakBot-facilitated ransomware and malware infections.
• Disruption of the QakBot botnet does not mitigate other previously installed malware or ransomware on victim computers.
• Indicators of compromise (IOCs) associated with QakBot infections are provided, including registry changes, file locations, and IP addresses.
• Best practice mitigations are recommended, including implementing a recovery plan, enforcing strong password policies, using phishing-resistant multi-factor authentication (MFA), keeping software up to date, and segmenting networks.
• Organizations are advised to review their security controls and test them against MITRE ATT&CK techniques associated with QakBot.
• The report emphasizes the importance of reporting ransomware incidents to the FBI or CISA and discourages paying ransoms.
• Additional resources and references for further information on QakBot and cybersecurity are provided.

Key Takeaway

The key takeaway from the web page is that the QakBot/Qbot malware, also known as Pinkslipbot, is a persistent and multifaceted threat that has been active since 2008. It is a banking Trojan that steals financial data and employs various techniques, including exploiting vulnerabilities and leveraging other tools, to infect and compromise systems. The malware is known for its constant evolution and adaptability.

Summary

• QakBot, also known as Qbot or Pinkslipbot, is a banking Trojan that has been active since 2008 and is continually evolving.
• It is described as a "Swiss Army knife" malware due to its multifunctionality.
• QakBot uses various infection vectors, including malspam, exploit kits, and Visual Basic script downloaders.
• To establish a foothold, it attempts to identify virtual environments and injects itself into legitimate processes like Internet Explorer.
• The malware can propagate through shared network drives, removable media, FTP servers, and SMB.
• QakBot's payloads include Powershell and Mimikatz, used for tasks like credential theft and lateral movement.
• Two major QakBot campaigns occurred in 2020, with a significant focus on targeting the healthcare industry.
• Mitigation practices include using YARA rules and implementing intrusion detection systems, spam filters, and access control.
• Numerous references and additional resources are provided for further research and understanding of QakBot's behavior and mitigation strategies.

Mitigation Strategies

To defend against Qakbot, organizations and individuals should employ a multi-layered security approach:

1. Email Security: Implement advanced email security solutions that can detect and quarantine phishing attempts and malicious attachments.
2. Regular Patching: Keep all systems and software updated to protect against vulnerabilities that Qakbot and other malware may exploit.
3. Endpoint Protection: Utilize modern antivirus and anti-malware solutions with behavioral analysis capabilities to detect and neutralize Qakbot infections.
4. Network Security: Employ firewalls, intrusion detection systems, and network segmentation to prevent the lateral movement of Qakbot within networks.
5. User Training: Educate users about the dangers of phishing and the importance of not opening attachments or clicking links from unknown or untrusted sources.
6. Backup and Disaster Recovery: Regularly back up critical data and ensure that robust disaster recovery procedures are in place to mitigate the impact of a Qakbot infection or any subsequent ransomware attack.
7. Threat Intelligence: Stay informed about the latest Qakbot indicators of compromise and tactics by subscribing to threat intelligence feeds and implementing the information into security monitoring systems.

Tracking 15 Years of Qakbot Development

Technical analysis of Qakbot’s 15-year evolution from a banking trojan to an initial access broker.

ZscalerJAVIER VICENTE - Sr. Staff Security Researcher

Conclusion

Qakbot represents a significant threat due to its evolving nature, sophistication, and the variety of tactics it employs. Its capability to cause financial loss, exfiltrate sensitive data, and serve as a conduit for further attacks makes it a formidable challenge. However, with a comprehensive and proactive cybersecurity strategy, the threat posed by Qakbot can be effectively managed and mitigated.