#qakbot — Public Fediverse posts

De digitale jacht: Hoe opsporingsdiensten de snelgroeiende dreiging van cybercriminaliteit in mei 2025 aanpakken

Artikel Cybercrimeinfo: https://www.ccinfo.nl/menu-nieuws-trends/opsporing/opsporing-cyber-nieuws/2548612_de-digitale-jacht-hoe-opsporingsdiensten-de-snelgroeiende-dreiging-van-cybercriminaliteit-in-mei-2025-aanpakken

Podcast Spotify: https://open.spotify.com/episode/0w3GQm2wVfjiJAHWV2IByo?si=8086d9aa890b4840

Podcast Youtube: https://youtu.be/yAruZwSgOsY?si=OkZ7SUb3C71oLuH-

#cybercrime #ransomware #opsoring #darkweb #fraude #cybercriminaliteit #nepagenten #phishing #digitaleoplichting #whatsappfraude #Qakbot #Nefilim #digitaleveiligheid #internationalecollaboratie #cyberdreigingen #darkwebwinkel

#BKA nennt Identität des mutmaßlichen Chefs der #Trickbot-Bande | heise online https://www.heise.de/news/BKA-nennt-Identitaet-des-mutmasslichem-Chefs-der-Trickbot-Bande-10421263.html #Malware #Ransomware #CyberCrime #Qakbot

Operation Endgame 2: 15 Millionen E-Mail-Adressen und 43 Millionen Passwörter | Security https://www.heise.de/news/Operation-Endgame-2-15-Millionen-E-Mail-Adressen-und-43-Millionen-Passwoerter-10396199.html #HaveIBeenPwned #Malware #Ransomware #Hacking #CyberCrime #Bumblebee #Latrodectus #Qakbot #DanaBot #HijackLoader #Warmcookie #Trickbot #Prolock #Doppelpaymer #REvil #Conti #BlackBasta #Cactus #OperationEndgame2

Operation Endgame 2.0: 20 Haftbefehle, Hunderte Server außer Gefecht gesetzt | Security https://www.heise.de/news/Operation-Endgame-2-0-20-Haftbefehle-Hunderte-Server-ausser-Gefecht-gesetzt-10394215.html #OperationEndgame #OperationEndgame2 #Malware #Ranswomware #Hacking #CyberCrime #Bumblebee #Latrodectus #Qakbot #DanaBot #HijackLoader #Warmcookie #Trickbot #Prolock #Doppelpaymer #REvil #Conti #BlackBasta #Cactus

Operation Endgame Takes Down DanaBot Malware, Neutralizes 300 Servers https://hackread.com/operation-endgame-danabot-malware-neutralizes-servers/ #OperationEndgame #Cybersecurity #CyberCrime #Security #TrickBot #Malware #DanaBot #Europol #Botnet #Qakbot

Operation Endgame Takes Down DanaBot Malware, Neutralizes 300 Servers – Source:hackread.com https://ciso2ciso.com/operation-endgame-takes-down-danabot-malware-neutralizes-300-servers-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #OperationEndgame #cybersecurity #CyberCrime #Hackread #security #TrickBot #DanaBot #Europol #malware #botnet #Qakbot

🔥 Operation Endgame is BACK! This time targeting #BumbleBee, #Latrodectus, #DanaBot, #WarmCookie, #Qakbot and #Trickbot!

Once again this is a HUGE win, with a truly international effort! 💪

As with phase one of #OperationEndgame, Spamhaus are providing remediation support - those affected will be contacted in due course with steps to take.

For more information, read our write-up here:
👉 https://www.spamhaus.org/resource-hub/malware/botnets-disrupted-worldwide-operation-endgame-is-back/

Russian Qakbot Gang Leader Indicted in US https://www.securityweek.com/russian-qakbot-gang-leader-indicted-in-us/ #RustamGallyamov #Cybercrime #charged #Qakbot #Russia #Qbot

Russian Qakbot Gang Leader Indicted in US https://www.securityweek.com/russian-qakbot-gang-leader-indicted-in-us/ #RustamGallyamov #Cybercrime #charged #Qakbot #Russia #Qbot

International Operation Targets Qakbot Hacker, $24M in Crypto Seized https://thecyberexpress.com/doj-indicts-alleged-qakbot-malware/ #RustamRafailevichGallyamov #USJusticeDepartment #ransomwareattacks #CryptoCrackdown #maliciousemails #RansomwareNews #cryptocurrency #FirewallDaily #Qakbotmalware #BlackBasta #CyberNews #Gallyamov #Qakbot #REvil #FBI

UPDATE: DOJ has now published a press release announcing the indictment of RUSTAM RAFAILEVICH GALLYAMOV, aka "Cortes" and other aliases.

Leader of Qakbot Malware Conspiracy Indicted for Involvement in Global Ransomware Scheme:

https://www.justice.gov/opa/pr/leader-qakbot-malware-conspiracy-indicted-involvement-global-ransomware-scheme

------------ Prior post:

Clever teasing by #OperationEndgame

A new vid about Qakbot, "My Happy Lie by Cortes" and they reset the countdown timer to 16 hours while linking to a DOJ press release dated today that has not yet been released:

"Russian national and leader of Qakbot malware conspiracy indicted in long-running global ransomware scheme"

#qakbot #malware

#Malware: #Qakbot mit falschen #Captchas verteilt | Security https://www.heise.de/news/Malware-Qakbot-mit-falschen-Captchas-verteilt-10335589.html #FakeCaptcha #FakeCaptchas

I wish every one of you to find someone who loves you like usernamegg loves #QakBot

Researchers Study Evolution of Ransomware Gang UNC4393’s Campaigns After QAKBOT Takedown https://thecyberexpress.com/researchers-ransomware-gang-unc4393s/ #TheCyberExpressNews #CybersecurityNews #BASTAransomware #TheCyberExpress #RansomwareNews #QAKBOTTakedown #FirewallDaily #UNC4393 #Qakbot

Трендовые уязвимости мая: лингвистический лесоруб и таинственный файл на ломаном английском

Хабр, привет! Уже по традиции я, Александр Леонов, ведущий эксперт лаборатории PT Expert Security Center, рассказываю про трендовые уязвимости месяца. Всего их было четыре: 1️⃣ уязвимость, приводящая к удаленному выполнения кода в многоплатформенном опенсорсном инструменте для сбора и обработки журналов Fluent Bit (CVE-2024-4323); 2️⃣ уязвимость, приводящая к удаленному выполнения кода в корпоративной веб-вики Confluence (CVE-2024-21683); уязвимости Microsoft, связанные с 3️⃣ обходом функций безопасности в Windows MSHTML Platform (CVE-2024-30040) и 4️⃣ повышением привилегий в Windows DWM Core Library (CVE-2024-30051). Узнать самые опасные уязвимости мая

https://habr.com/ru/companies/pt/articles/820613/

#трендовые_уязвимости #cve #vulnerability_management #microsoft #эксплойт #confluence #dwm #qakbot #ole #патчи

🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies 👏👏

As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.

👉 For more information, read our write-up here: https://www.spamhaus.org/resource-hub/malware/operation-endgame-botnets-disrupted-after-international-action/

#OperationENDGAME

Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware – Source: securityboulevard.com https://ciso2ciso.com/defend-your-business-testing-your-security-against-qakbot-and-black-basta-ransomware-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #blackbasta #ransomware #QakBot

Patch Tuesday, May 2024 Edition

https://krebsonsecurity.com/2024/05/patch-tuesday-may-2024-edition/

#AdobeSubstance3DPainter #macOSSonoma14.5update #AdobeFramemaker #CVE-2024-30040 #CVE-2024-30044 #CVE-2024-30051 #ImmersiveLabs #AdobeAnimate #GoogleChrome #SatnamNarang #TimetoPatch #Illustrator #KevinBreen #Sharepoint #AdobeAero #acrobat #Tenable #MSHTML #Qakbot #reader

QakBot attacks with Windows zero-day (CVE-2024-30051) – Source: securelist.com https://ciso2ciso.com/qakbot-attacks-with-windows-zero-day-cve-2024-30051-source-securelist-com/ #Vulnerabilitiesandexploits #rssfeedpostgeneratorecho #zerodayvulnerabilities #CyberSecurityNews #MicrosoftWindows #vulnerabilities #securelistcom #Software #QakBot

Patch Tuesday, May 2024 Edition – Source: krebsonsecurity.com https://ciso2ciso.com/patch-tuesday-may-2024-edition-source-krebsonsecurity-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #KrebsonSecurity #KrebsOnSecurity #ImmersiveLabs #GoogleChrome #SatnamNarang #Illustrator #TimetoPatch #KevinBreen #SharePoint #Acrobat #Tenable #QakBot #reader

Financial cyberthreats in 2023 – Source: securelist.com https://ciso2ciso.com/financial-cyberthreats-in-2023-source-securelist-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Financialmalware #Financialthreats #MicrosoftWindows #SpamandPhishing #Windowsmalware #GoogleAndroid #MobileMalware #Mobilethreats #securelistcom #Publications #TrojanBanker #Phishing #Emotet #QakBot #fraud

Spam and phishing in 2023 – Source: securelist.com https://ciso2ciso.com/spam-and-phishing-in-2023-source-securelist-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Spammertechniques #Phishingwebsites #Thematicphishing #SpamandPhishing #SpamStatistics #securelistcom #Thematicspam #SpamLetters #Phishing #Telegram #Malware #QakBot #Trojan

Cybercriminals are using #Scalable_Vector_Graphics (#SVG) files to deliver malware because SVG is an XML-based vector image format for two-dimensional graphics that supports interactivity and animation. SVG files can natively contain #JavaScript code, which can be executed by browsers when the SVG is loaded.
They do this by leveraging the #AutoSmuggle tool introduced in May 2022. This tool embeds malicious files into SVG/HTML content, bypassing security measures. Notably, SVG files were exploited to distribute #ransomware in 2015 and the #Ursnif malware in January 2017. A significant advancement occurred in 2022, with malware like #QakBot being delivered through SVG files containing embedded .zip archives. AutoSmuggle campaigns in December 2023 and January 2024 delivered the #XWorm #RAT and #Agent_Tesla #Keylogger, respectively, showcasing a shift towards embedding executable files directly within SVG files to evade detection by Secure Email Gateways (#SEGs). This evolution underscores the need for updated security measures to combat sophisticated malware delivery methods.
The misuse of SVG files for malware distribution dates back to 2015, with ransomware being one of the first to be delivered through this vector.
Original report: Cofense

The good news is that these samples are all consistently caught and stopped in Sophos products with our existing endpoint detection rules.

The Evade_34b (mem/prchollow-b) detections in Sophos Endpoint trigger as soon as Qakbot tries to perform the initial process injection.

Qakbot has only trickled out a few samples, but the botnet was so large at one point, and so omnipresent, that any activity by threat actors to bring it back deserves surveillance and scrutiny. X-Ops analysts will continue to keep a close eye on any new developments.
10/10
#Qakbot #malware #spam

One final curiosity we observed: When run under Windows, the #Qakbot malware spawned a small popup box that makes it appear something called Adobe Setup was running. On some test systems, the Qakbot DLL drops a copy of itself named Adobe.dll.

If the user clicks the X in the small dialog, the malware spawns a dialog that says "Are you sure you want to cancel Adobe installation?"

The #malware installs without regard to what you click.
9/

Prior generations of #Qakbot added, then later removed, the ability to detect whether the malware was running inside a virtual machine. This generation has brought back those checks, and will enter an infinite loop if it finds itself in a VM.

It also places a duplicate copy of the malware in the user's %TEMP% folder with an 8-random-character filename.
8/
#malware #spam