Qakbot Threat Actors Distributing Ransom Knight And Remcos

QAKBOT

Executive Summary

Threat actors affiliated with Qakbot were observed distributing Ransom Knight ransomware and Remcos RAT.

Key Takeaways

Threat actors affiliated with Qakbot were observed distributing Ransom Knight ransomware and Remcos RAT.
This activity has persisted, despite the law enforcement takedown of Qakbot infrastructure in August.
The threat actors used malicious LNK files, likely distributed via phishing emails, to deliver the malware.

The Campaign

Threat actors affiliated with Qakbot were observed distributing Ransom Knight ransomware and Remcos RAT since at least early August 2023. Despite the FBI seizing Qakbot infrastructure in late August, this activity has continued. Cisco Talos recently reported on this activity.

In this campaign, the threat actors used malicious LNK files, likely distributed via phishing emails, to deliver the malware. When the LNK file is launched, it begins the infection chain and deploys Ransom Knight. ZIP archives containing the LNK files were also observed using XLL files to distribute Remcos RAT. Cisco Talos researchers noted the use of file names written in Italian, which may indicate the threat actors intended to target Italian speaking users.

Attribution of this activity was based on metadata found in LNK files used in the campaign, which matches metadata used in previous Qakbot campaigns. While Qakbot suffered a takedown in August, this campaign seems to indicate that at least part of their infrastructure remains and that the threat actors are not deterred from future campaigns. It remains to be seen whether Qakbot malware itself will rise again.

What is Ransom Knight?

Ransom Knight, based on Cyclops ransomware, is ransomware as a service (RaaS). It has been in the wild since August 2023 and has been advertised on the RAMP forum. Ransom Knight is typically delivered via spearphishing. Windows, Linux, and MacOS encryptor payloads are available. Encrypted files have a .knight, .knightl, or .knight_l extension appended to the file name, and a ransom note is written to each folder containing encrypted files.

What is Remcos?

Remcos (Remote Control & Surveillance Software) is a sophisticated backdoor that provides full and persistent remote access to infected machines. While marketed as legitimate surveillance software, it is often used by malicious actors. Remcos is known to use process injection or process hollowing to help evade detection. Remcos is capable of key logging, capturing screenshots, recording audio, stealing clipboard contents, collecting passwords, and stealing other information. Remcos also allows threat actors to optionally deploy additional payloads.