QakBot Strikes Again: Targeting Hospitality Industry with New Tactics
The QakBot malware has resurfaced with a new wave of phishing messages targeting the hospitality industry, more than three months after its infrastructure was dismantled by law enforcement. The low-volume campaign began on December 11, 2023, with targets receiving a PDF from a user posing as an IRS employee. The PDF contained a URL that downloaded a digitally signed Windows Installer, leading to the invocation of QakBot. The malware is capable of harvesting sensitive information and delivering additional malware, including ransomware. The return of QakBot highlights the need for organizations to be vigilant against spam emails and cyber threats.