Qakbot-affiliated actors distribute Ransom Night malware despite infrastructure takedown

• The threat actors behind the Qakbot malware have been conducting a campaign since early August 2023 in which they have been distributing Ransom Knight ransomware and the Remcos backdoor via phishing emails.


• Notably, this activity appeared to begin before the FBI seized Qakbot infrastructure in late August and has been ongoing since, indicating the law enforcement operation may not have impacted Qakbot operators’ spam delivery infrastructure but rather only their command and control (C2) servers.


• Talos attributed this new campaign …

august backdoor campaign emails fbi infrastructure malware phishing phishing emails qakbot qakbot malware ransom ransomware remcos seized takedown threat threat actors