Qakbot

Last Updated : 27 Jul, 2026

QakBot remains one of the most dangerous malware threats in modern cybersecurity because it combines stealth, persistence, credential theft and ransomware delivery into a single attack chain. It evolved from a standalone Trojan into a versatile malware platform, maintained and distributed by organized cybercriminal groups.

  • Expansion from simple credential theft to full scale network compromise
  • Integration with other malware families such as Emotet and TrickBot
  • Adoption as a loader for ransomware campaigns, including Conti, REvil and Black Basta

QakBot Attack Lifecycle

QakBot operates through a structured, multi-stage attack chain that transforms an initial compromise into full network control and, often, ransomware deployment.

qakbot_workflow
LIFECYCLE

Step 1: Initial Access - Business Email Compromise (BEC)

Attacks typically begin with phishing emails sent from compromised or spoofed business accounts. These messages often appear legitimate, referencing invoices, HR updates, or internal communications.

  • Malicious Microsoft Excel or Word attachments with embedded macros
  • Links to fake cloud storage pages hosting malware payloads

Step 2: Payload Execution - QakBot Activation

After execution, QakBot injects itself into legitimate Windows processes such as: explorer.exe, svchost.exe, wermgr.exe

  • Modifying registry keys for persistence
  • Creating scheduled tasks or startup entries

Step 3: Privilege Escalation - Domain Administrator Compromise

Once active, QakBot begins harvesting sensitive credentials from the infected machine and network.

  • Extracting browser-stored credentials and session cookies
  • Collecting email data, including contact lists and conversation threads
  • Harvesting Windows credentials using tools similar to Mimikatz
  • Conducting network reconnaissance via LDAP queries and SMB enumeration

Step 4: Lateral Movement - Cobalt Strike Deployment

After gaining elevated privileges, attackers deploy:

  • Remote execution via PsExec and Windows Management Instrumentation (WMI)
  • SMB-based propagation to accessible systems
  • Deployment of Cobalt Strike beacons for command execution and pivoting

Step 5: Payload Delivery - Ransomware Deployment

Once attackers achieve full visibility and control over the environment, they launch:Conti ransomware.

  • Encrypt critical systems and data
  • Exfiltrate sensitive information

Technical Components

1. Command and Control (C2)

QakBot maintains communication with attacker-controlled infrastructure through resilient and covert channels.

  • Encrypted HTTPS Communication: Modern malware uses HTTPS (port 443) to hide traffic within legitimate encrypted web traffic, making detection harder.
  • Peer-to-Peer (P2P) Fallback: If main C2 servers are blocked, infected machines can share commands among themselves using P2P communication, ensuring persistence.
  • Domain Generation Algorithms (DGAs): Malware generates random domain names daily to connect to new C2 servers dynamically, avoiding static detection.
  • Beaconing Behavior: The malware periodically “beacons” (pings) the C2 for updates, exfiltrates data, or receives new commands.
  • Redundancy and Resilience: Multiple C2 channels (HTTP, DNS tunneling, Tor) are often built in so that if one is disrupted, others continue the operation.

2. Modules

Malware uses modular architecture, meaning it loads additional components for specific malicious functions.

  • Credential Theft Module: Extracts credentials from browsers, memory (e.g., LSASS process), or password vaults like Windows Credential Manager.
  • Email Harvesting Module: Scans Outlook, Thunderbird, or stored PST files to gather contact lists for further phishing campaigns.
  • Proxy Tunneling Module: Converts infected hosts into proxy servers to hide attacker traffic and enable lateral movement.
  • Modular Design Flexibility: Attackers can update or deploy new modules without reinstalling the malware, making it adaptive.
  • Persistence Modules: Some modules ensure the malware reactivates after reboot (via scheduled tasks, registry keys, or services).

3. Anti-Analysis Techniques

These are defensive mechanisms inside malware designed to evade detection or hinder analysts.

  • Virtual Machine (VM) Detection: Malware checks system artifacts (e.g., VMware drivers, sandbox file names) and stops running if a sandbox is detected.
  • Execution Delay (Time Bombs): Introduces artificial delays (e.g., 5-10 minutes) before activating, tricking analysts who observe short execution windows.
  • Encrypted Internal Configuration: Stores its config (C2 URLs, encryption keys, campaign IDs) in encrypted form to prevent easy reverse engineering.
  • Code Obfuscation and Packing: Uses packers or encryption layers to hide actual malicious code from static analysis tools.
  • Anti-Debugging Tricks: Detects debugging tools (like OllyDbg or x64dbg) or manipulates API calls to crash debuggers during inspection.

Prevention Of QakBot Attacks

  • Employee Security Awareness Training: Train employees to identify Phishing emails, Suspicious attachments, Fake login pages.
  • Multi-Factor Authentication (MFA): Enable MFA across VPNs, Email systems, Administrative accounts.
  • Endpoint Detection and Response (EDR): Deploy advanced security tools capable of Behavioral analysis, Threat hunting, Memory scanning.
  • Patch Management: Keep Operating systems, Applications, Firmware, Security tools fully updated.
  • Network Segmentation: Separate critical systems to reduce lateral movement opportunities.
  • Backup Strategy: Maintain Offline backups, Immutable backups, Regular recovery testing.

Real-World Example - QakBot Attack on a Financial Services Firm (2021)

1. Initial Compromise: Phishing Entry Point

  • The attack began with a phishing email that appeared to come from the company’s HR department, referencing an “Updated Employee Policy” or “Benefits Review.”
  • The email contained an Excel attachment with malicious macros.
  • When an employee opened it and enabled macros, it silently downloaded and executed the QakBot payload.
  • The email looked authentic, came from a trusted internal-looking domain and used social engineering (HR-related topics) to lower suspicion.

2. Payload Execution - QakBot Activation

  • Once executed, QakBot injected itself into legitimate system processes like explorer.exe to stay hidden.
  • It established persistence by modifying registry keys and creating scheduled tasks, ensuring it survived reboots.
  • Impact: The malware gained a permanent foothold in the corporate network, undetected by standard antivirus tools.

3. Privilege Escalation - Domain Administrator Compromise

  • QakBot quickly began harvesting credentials using built-in modules and tools like Mimikatz.
  • With stolen credentials, attackers escalated privileges to gain Domain Administrator access, giving them full control over the network.

4. Lateral Movement - Cobalt Strike Deployment

  • Attackers then deployed Cobalt Strike beacons, which allowed remote control of multiple systems.
  • Through PsExec, SMB and WMI, they moved laterally to critical servers and data centers.
  • Purpose: To spread QakBot and prepare for a coordinated ransomware attack.

5. Final Stage - Ransomware (Conti) Execution

  • Once the attackers had full network visibility, they launched Conti ransomware, encrypting business-critical files and databases.
  • A ransom note appeared, demanding multi-million-dollar payments in cryptocurrency to decrypt data and avoid public leaks.
Comment

Explore