Huntress Reports Rising Qakbot Activity and Shares Defensive Guidance
Summary
Huntress reported a 400% rise in Qakbot cases over two months and outlined its email-based infection chain, persistence methods, and steps to reduce exposure and contain infected hosts.
Key points
- Huntress reported a 400% increase in Qakbot cases over two months, based on telemetry across its protected endpoints.
- The observed infection chain often starts with an email HTML attachment that drops a ZIP; a user opens an ISO and clicks a shortcut that launches Qakbot.
- Qakbot DLLs may run through regsvr32.exe or rundll32.exe, or be loaded through DLL sideloading with legitimate applications.
- The article says Qakbot can establish persistence through a Run key or Scheduled Task and may spread through SMB administrative shares.
- Suggested precautions include email filtering, user awareness training, regular patching, and considering limits on ISO mounting or administrative shares where appropriate.
- For active infections, Huntress recommends quickly isolating infected hosts and carefully containing the environment to reduce spread and reinfection.
Article Details
- Defense Focus
- Detect and contain Qakbot infections early, limit its delivery and execution paths, and prevent propagation and reinfection.
- Detection Methods
- Monitor email-delivered HTML attachments followed by ZIP files in user Downloads, ISO or VHD mounting, and execution of a .LNK file from the mounted image.
- Investigate suspicious .cmd or .js scripts that launch Qakbot DLLs through regsvr32.exe or rundll32.exe, including DLL sideloading involving calc.exe or control.exe.
- Monitor process execution and injection, including Qakbot activity in wermgr.exe, and watch for enumeration commands.
- Hunt for Qakbot moving to a new folder and creating persistence through Run keys or Scheduled Tasks, especially when regsvr32.exe or rundll32.exe is involved.
- Monitor SMB-share activity for Qakbot propagation between machines.
- Data Sources
- Endpoint process execution and process relationships
- Windows registry Run keys
- Scheduled Tasks
- Email and attachment telemetry
- File activity in user Downloads and mounted ISO/VHD images
- SMB share activity
- Defensive Actions
- Use email filtering and security awareness training to reduce exposure to malicious attachments.
- Consider restricting ISO mounting through registry configuration; use more aggressive monitoring instead where ISO use is required.
- Maintain a regular patching and update cadence.
- Consider disabling administrative SMB shares on workstations after assessing operational impact.
- Isolate infected hosts or networks promptly; use a separated dedicated LAN where appropriate.
- Remediate infections hands-on and thoroughly to reduce spread and reinfection; discuss potential downtime in advance.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesSome Qakbot variants propagate to multiple machines via SMB shares.T1053.005 · Scheduled TaskQakbot creates persistence through a Scheduled Task.T1055 · Process InjectionAfter execution, Qakbot injects into wermgr.exe.T1204.002 · Malicious FileUsers unzip the delivered archive and interact with a .LNK file that mounts an ISO, initiating Qakbot execution.T1218.010 · Regsvr32Qakbot DLLs are typically executed using regsvr32.exe.T1218.011 · Rundll32Qakbot DLLs are typically executed using rundll32.exe.T1547.001 · Registry Run Keys / Startup FolderQakbot creates persistence through a Run key.T1566.001 · Spearphishing AttachmentQakbot initial access was primarily through email HTML attachments that dropped ZIP files.T1574.002 · DLL Side-LoadingHuntress observed Qakbot DLLs loaded through DLL sideloading, including use of calc.exe or control.exe.