Ankura CTIX FLASH Update - December 19, 2023

Ransomware/Malware Activity

QakBot Resurfaces in Phishing Campaign masquerading as IRS Employees

Qakbot, the botnet known for its phishing campaigns and injection into legitimate Windows processes to avoid detection, has reappeared in a new campaign targeting the hospitality industry. On December 15, 2023, Microsoft made a series of posts on X, formerly known as Twitter, describing their findings which involve a threat actor using PDFs to distribute the malware. This is despite Operation Duck Hunt, a multinational effort to bring down the Qakbot network and infrastructure, that was successfully executed earlier this year. Microsoft reported that threat actors are attempting to masquerade as IRS employees and distribute the Qakbot malware via malicious files through this new round of phishing. When the victim attempts to access the PDF, it will instead prompt them to download it for proper viewing which will actually download a ".msi" Windows installer file. Once