QakBot eCrime Campaign Leverages Microsoft OneNote Attachments

Originally published by CrowdStrike. In November 2021[1] and February 2022[2], Microsoft announced that by default it would block Excel 4 and VBA macros in files that were downloaded from the internet. Following these changes, CrowdStrike Intelligence observed eCrime adversaries that had previously relied on macro execution for malware delivery adapt their tactics, techniques and procedures (TTPs). Many adversaries began to use ISO files containing LNKs that then started the rest of the infec...

adversaries attachments block campaign crowdstrike default delivery excel february files intelligence internet macro macros malware microsoft microsoft onenote november onenote qakbot tactics techniques vba vba macros