Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4

The threat actors behind the Black Basta^[1]
ransomware family^[2]
have been observed using the Qakbot trojan to deploy the Brute
Ratel C4 framework as a second-stage payload in recent attacks.

The development marks the first time the nascent adversary simulation
software^[3] is being delivered via a
Qakbot infection, cybersecurity firm Trend Micro said^[4]
in a technical analysis released last week.

The intrusion, achieved using a phishing email containing a
weaponized link pointing to a ZIP archive, further entailed the use
of Cobalt Strike for lateral movement.

While these legitimate utilities are designed for conducting
penetration testing activities, their ability to offer remote
access has made them a lucrative tool in the hands of attackers
looking to stealthily probe the compromised environment without
attracting attention for extended periods of time.

This has been compounded by the fact that a cracked version^[5]
of Brute Ratel C4 began circulating last month across the
cybercriminal underground, prompting its developer to update the licensing algorithm^[6] to make it harder to
crack.

Qakbot^[7], also called QBot and
QuackBot, is an information stealer and banking trojan that’s known
to be active since 2007. But its modular design and its ability to
act as a downloader has turned it into an attractive candidate for
dropping additional malware.

According to Trend Micro, the ZIP file in the email contains an
ISO file, which, in turn, includes a LNK file that fetches the
Qakbot payload, illustrating attempts on part of threat actors to
adapt to other
tactics^[8] in the aftermath of
Microsoft’s decision to block
macros^[9] by default for documents
downloaded from the web.

The Qakbot infection is succeeded by the retrieval of Brute
Ratel and Cobalt Strike, but not before performing automated
reconnaissance through built-in command line tools such as arp,
ipconfig, nslookup, netstat, and whoami.

The attack, however, was stopped before any malicious action
could be taken by the threat actor, although it’s suspected that
the end goal may have been domain-wide ransomware deployment.

In another Qakbot execution chain spotted by the cybersecurity
company, the ZIP file is delivered through an increasingly popular
method called HTML smuggling^[10], resulting in the
execution of Brute Ratel C4 as the second-stage.

“The Qakbot-to-Brute Ratel-to-Cobalt Strike kill chain is
associated with the group behind the Black Basta Ransomware,” the
researchers said. “This is based on overlapping TTPs and
infrastructure observed in Black Basta attacks.”

The findings coincide with a resurgence of Qakbot attacks in
recent months by means of a variety of techniques like HTML file attachments^[11], DLL side-loading^[12], and email thread hijacking^[13], the last of which
entailed harvesting emails in bulk from successful ProxyLogon attacks^[14] aimed at Microsoft
Exchange servers.

IcedID Actors Diversify Delivery Methods

Qakbot is far from the only access-as-a-service malware that’s
being increasingly distributed via ISO and other file formats to
get around macro restrictions, for Emotet^[15], IcedID^[16], and Bumblebee^[17] campaigns have all
followed similar trajectories.

Palo Alto Networks Unit 42, in late September 2022, said^[18] it discovered a
malicious polyglot Microsoft Compiled HTML Help (CHM) file being
used to deliver the IcedID (aka BokBot) malware.

Other prominent delivery methods and infection pathways have
involved the use of password-protected ZIP files containing an ISO
file, mirroring that of Qakbot, with the payload propagated through
a pay-per-installer service known as PrivateLoader^[19], according to Team Cymru^[20].

And, to top it all, Emotet^[21] appears to be readying
for a fresh set of attacks after a short three-month hiatus to
rework its “systeminfo” module to “improve targeting of specific
victims and distinguish tracking bots from real users,” ESET
disclosed^[22] in a series of
tweets.

“We have not seen new spam waves^[23] from Emotet since
July,” Jean-Ian Boutin, director of threat research at ESET, told
The Hacker News. “It is not clear why that is.”

“They did take some breaks in the past, but never for that long.
Perhaps this new module means that they are testing modules and
will be active again in the near future, but this of course is
speculation.”