SecuriTricks - qakbot

Qbot is Back.Connect

Qbot, an information stealer active since 2007, has re-emerged after a law enforcement disruption in May 2024. New research reveals connections between Qbot, Zloader, and BlackBasta ransomware. A new backConnect malware, likely developed by Qbot operators, uses DLL side-loading techniques and RC4 e…

qakbot

qbot

quackbot

2025-01-22

Published: January 22, 2025

Downloadable IOCs: 0

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

The report describes a recent campaign by the threat actor Storm-1811, a financially motivated cybercriminal group known for deploying Black Basta ransomware. The campaign begins with social engineering tactics like voice phishing (vishing) and email bombing to trick users into granting remote acce…

Published: May 16, 2024

Downloadable IOCs: 12

StopRansomware: Black Basta

This advisory details tactics, techniques, procedures and indicators of compromise related to Black Basta ransomware, a variant first identified in April 2022. Its affiliates have impacted over 500 organizations globally across multiple critical infrastructure sectors, including Healthcare and Publ…

Published: May 13, 2024

Linked vulnerabilities : CVE-2021-42287, CVE-2021-42278, CVE-2024-1709, CVE-2021-34527, CVE-2020-1472

Downloadable IOCs: 174

Tag: qakbot

Attack reports

Qbot is Back.Connect

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

StopRansomware: Black Basta