QakBot’s Low-Volume Resurgence Targets Hospitality

Cybersecurity researchers spotted new QakBot activity targeting the hospitality industry last week.

According to a Saturday post on X (formerly Twitter) by CronUp cyber threat intelligence specialist Germán Fernández, the new attacks are characterized by low volume and have been traced back to a campaign labeled tchk06, Version 0x500. 

Fernández identified a specific operational approach in which the malicious files advance through email, PDF, URL and MSI. 

Notably, these harmful files are authenticated with the signature “SOFTWARE AGILITY LIMITED.” The PDF template employed in these attacks is identical to the one recently used by the PikaBot malware.

Microsoft Threat Intelligence also reported on the QakBot phishing campaigns on Saturday, identifying their initiation on December 11. The phishing attempts have been notably subtle, with targets receiving a PDF from an imposter posing as an IRS employee. 

On the same day, Zscaler ThreatLabz shed light on the technical aspects of the renewed QakBot, revealing it to be a 64-bit version utilizing AES for network encryption. The malware sends POST requests to the path /teorema505, indicating a shift in tactics compared to previous iterations.

The significance of this QakBot resurgence lies in its adaptation to evade prior disruption efforts, employing a familiar PDF template to exploit vulnerabilities within the hospitality sector. 

The new attacks are a notable development following previous efforts to dismantle the malware earlier this year. Notably, Operation Duck Hunt, an FBI-led initiative, successfully shut down QakBot malware on August 30 2023. 

Read more on this operation: FBI-Led Operation Duck Hunt Shuts Down QakBot Malware

Despite the apparent success of this operation, subsequent reports in October highlighted that the QakBot gang remained active, indicating the persistent challenges in completely eradicating such threats.

Infosecurity will continue to follow developments regarding the QakBot malware and provide updates about the latest attacks as soon as they are available.