Chain of Events Email –> link –> downloaded zip archive –> extracted Excel file –> enable macros –> HTTPS traffic for Qakbot DLL files –> Qakbot C2 activity –> DarkVNC traffic Images Shown above: Link from an email distributing Qakbot (“aa” distribution tag) in a web browser. Shown above: Downloaded zip archive and extracted spreadsheet. […]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Source: Read More (SANS Internet Storm Center, InfoCON: green)
The time that attackers stay hidden inside an organization’s networks is shifting, putting pressure on defenders and upping the need to detect and respond to threats in real-time. Source: Read More (Threatpost)