Representing a new evolution of banking trojan, QakBot proves to be a formidable adversary against security defenses with its’ ability to steal emails – your users.
The most effective tools a threat actor can have are context and credibility. These are the foundational elements of a really good social engineering scam. Historically, threat actors have simply used online services such as LinkedIn to identify individuals with specific roles in a target victim organization, and any public-facing detail (e.g., social media, press releases, etc.) to craft believable social engineering.
But according to security researchers at Kaspersky, the newest version of QakBot takes the discovery portion of building a social engineering scam to a whole new level. In addition to the ability to steal keystrokes cookie, browser-based passwords, and login credentials, QakBot now has the ability to exfiltrate email content from the infected endpoint. This detail can be easily used in future attacks to establish credibility, commit fraud, and more when used against those in the initial victim’s contact list. This new ability to capture email may be the reason Kaspersky is seeing QakBot’s use is up 65% compared to last year.
If you add a QakBot-based attack with a Business Email Compromise attack (which organizations already have as much as an 85% chance of experiencing weekly), the added degrees of context and detail potentially extracted from stolen emails could make a malwareless attack all but undetectable to its’ victim.
This is why every user needs to undergo continual Security Awareness Training so they can be made aware of the kinds of attacks that are being experienced, what to look for, and to be so vigilant that anytime an unusual or unexpected request is made via email. Users should know to err on the side of caution, whether or not they know the sender.
Are you aware that one of the
