The Botnet Makes Detailed Profile Scans of Infected Computers, Downloads Additional Modules and Features Elaborate Encryption

OXFORD, U.K. — Marzo 10, 2022 —

Sophos, a global leader in next-generation cybersecurity, today published a technical deep dive into Qakbot, explaining how the botnet is a becoming more advanced and dangerous to organizations. In a new article, “Qakbot Injects Itself into the Middle of Your Conversations,” Sophos researchers detail a recent Qakbot campaign that shows how the botnet spreads through email thread hijacking and collects a wide range of profile information from newly infected machines, including all the configured user accounts and permissions, installed software, running services, and more. The botnet then downloads a series of additional malicious modules that enhance the functionality of the core botnet, according to Sophos.

Qakbot’s malware code features unconventional encryption, which it also uses to conceal the content of its communications. Sophos decrypted the malicious modules and decoded the botnet’s command and control system to interpret how Qakbot receives instructions.

“Qakbot is a modular, multi-purpose botnet spread by email that has become increasingly popular with attackers as a malware delivery network, like Trickbot and Emotet,” said Andrew Brandt, principal threat researcher at Sophos. “Sophos’ deep analysis of Qakbot reveals the capture of detailed victim profile data, the botnet’s ability to process complex sequences of commands, and a series of payloads to extend the functionality of the core botnet engine. The days of thinking of ‘commodity’ bots as merely annoying are long gone.

 “Security teams need to take seriously the presence of Qakbot infections on their network and investigate and remove every trace. Botnet infections are a known precursor for a ransomware attack. This is not simply because botnets can deliver ransomware, but because botnet developers sell or lease their access to breached networks. For example, Sophos has encountered Qakbot samples that deliver Cobalt Strike beacons directly to an infected host. Once the Qakbot operators have used the infected computer they can transfer, lease out or sell access to these beacons to paying customers.”

The Qakbot Infection Chain and Payloads

In the campaign Sophos analyzed, the Qakbot botnet inserted malicious messages into existing email conversations. The inserted emails include a short sentence and a link to download a zip file containing a malicious Excel spreadsheet. The user was asked to “enable content” to activate the infection chain. Once the botnet had infected a new target it performed a detailed profile scan, sharing the data with its command-and-control server and then downloading additional malicious modules.

The Qakbot botnet downloaded at least three different malicious payloads in the form of dynamic link libraries (DLL).  According to Sophos, these DLL payloads provide the botnet with a wider range of capabilities.

The payloads were injected into browsers and contained the following:

  • A module that injects password-stealing code into webpages
  • A module that performs network scans, collecting data about other machines in proximity to the infected computer
  • A module that identified the addresses of a dozen SMTP (Simple Mail Transfer Protocol) email servers and then tried to connect to each one and send spam

Sophos Security Advice

Sophos recommends that users approach unusual or unexpected emails with caution, even when the messages appear to be replies to existing email threads. In the Qakbot campaign investigated by Sophos, a potential red flag for recipients was the use of Latin phrases in URLs.

Security teams should check that the behavioral protections provided by their security technologies prevent Qakbot infections from taking hold. Network devices will also alert administrators if an infected user attempts to connect to a known command-and-control address or domain.

Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of attackers.

For further information read “Qakbot Injects Itself into the Middle of Your Conversations” on SophosLabs Uncut.

Informazioni su Sophos

Sophos è un’azienda leader nell’ambito della cybersecurity e protegge 600.000 organizzazioni in tutto il mondo con una piattaforma basata sull’IA e servizi a cura di esperti. Sophos viene incontro alle esigenze delle organizzazioni, adattandosi al loro livello di maturità di sicurezza informatica e crescendo insieme ai clienti per tutelarli dai cyberattacchi. La sua soluzione offre la combinazione ottimale tra machine learning, automazione e dati di intelligence sulle minacce in tempo reale, aggiungendo le competenze umane degli esperti del team Sophos X-Ops, che lavorano in prima linea per garantire monitoraggio, rilevamento e risposta alle minacce 24/7.
Sophos offre un servizio di Managed Detection and Response (MDR) leader di settore, nonché una linea completa di tecnologie di sicurezza, tra cui soluzioni per la protezione di endpoint, rete, e-mail e cloud, nonché Extended Detection and Response (XDR), rilevamento delle minacce all’identità (Identity Threat Detection and Response, ITDR) e SIEM next-gen. Unite a servizi di consulenza a cura di esperti, queste funzionalità aiutano le organizzazioni a ridurre proattivamente il rischio e a rispondere in maniera più tempestiva, ottenendo il giusto livello di visibilità e scalabilità richiesto per tenersi un passo avanti rispetto a minacce in continua evoluzione.
La strategia go-to-market di Sophos si basa su un ecosistema di Partner che include Managed Service Provider (MSP), Managed Security Service Provider (MSSP), Rivenditori e Distributori, integrazioni per il marketplace, e Partner Cyber Risk; questa strategia offre alle organizzazioni la flessibilità di scegliere come stabilire rapporti di fiducia per la protezione della loro attività.  Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.