QakBot

Also known as: Qbot, Pinkslipbot, QuackBot

QakBot began as a banking trojan in the late 2000s and became a major malware delivery botnet used by ransomware affiliates. In August 2023 an FBI-led international operation took over the botnet and pushed an uninstaller to infected computers; the US Department of Justice said the FBI had identified more than 700,000 computers worldwide that appeared to be infected.

Public attribution and associated actors: MITRE ATT&CK lists QakBot as used by TA551, TA577 and Storm-1811; CISA reported QakBot infections as an initial access route for Black Basta and other ransomware.As publicly reported:Black BastaTA551TA577
First seen: Around 2007
Platforms: Windows
MITRE ATT&CK software entries: S0650 QakBot

Status: Disrupted in August 2023 by an FBI-led operation with international partners, which redirected infected computers to FBI servers and uninstalled the malware (US Department of Justice).

How it spreads or gets in

Phishing emails carrying malicious links, archives, HTML smuggling or Office documents.
Spread inside networks through shares and removable media.

Key behaviours

Injected into legitimate processes and used signed Windows binaries to run.
Logged keystrokes and hijacked browser sessions.
Delivered follow-on tools for ransomware affiliates.

ATT&CK techniques

Selected from the family's MITRE ATT&CK software entry.

Detection ideas

Alert on regsvr32 or rundll32 loading files from user-writable folders.
Detect archive or ISO files from email that launch scripts.
Treat QakBot detections as ransomware precursors.

Defences that work

Block risky attachment types such as ISO and HTML at the email gateway.
Use application control to stop signed system binaries running files from user folders.
Contain infected hosts quickly and reset credentials used on them.

Sources

Loader / botnetATT&CK S0650