Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.

Read More

Detects messages with PDF attachments linking directly to zip files from unsolicited senders.

Read More

Detects a PDF attachment with a link to a ZIP file that contains a WSF file

Read More

A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot.

Read More

A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.

Read More

A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.

Read More

Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.

Read More

Detects a PDF attachment with a link that contains a Google.ae redirect URL.

Read More

Detects a known Qakbot delivery method, zip file with pdf, txt and wsf file at a depth of 1

Read More

HTML attachments containing base64-encoded files that are downloaded via embedded hyperlinks. This TTP is used by attackers to bypass email and web filters since the file is not downloaded from an external source. Recently observed delivering Qakbot.

Read More