Qakbot Being Distributed via OneNote

Back in January, AhnLab ASEC published an analysis report on a malware strain that was being distributed through Microsoft (MS) OneNote.

Analysis Report on Malware Distributed via Microsoft OneNote

As mentioned in the report, there has recently been an increasing number of cases where commodity malware like Qakbot stopped using MS Office Macro, their past distribution method, and instead started to use OneNote to execute their malware.

Figure 1. Distribution trend of malicious OneNote files in 2022

If you look …

ahnlab analysis asec back cases commodity malware distributed distribution files january macro malicious malware malware analysis microsoft microsoft onenote ms office office onenote qakbot report trend