QakBot
Software · ATTACK:enterprise:S0650
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0650",
"title": "QakBot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0650",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--edc5e045-5401-42bb-ad92-52b5b2ee0de9",
"external_id": "S0650",
"domain": "enterprise",
"created": "2021-09-27T19:35:35.326Z",
"modified": "2024-11-17T13:02:32.758Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "QuackBot"
},
{
"source_name": "Pinkslipbot"
},
{
"source_name": "QBot"
},
{
"source_name": "Kaspersky QakBot September 2021",
"url": "https://securelist.com/qakbot-technical-analysis/103931/"
},
{
"source_name": "ATT QakBot April 2021",
"url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
},
{
"source_name": "Red Canary Qbot",
"url": "https://redcanary.com/threat-detection-report/threats/qbot/"
},
{
"source_name": "Trend Micro Qakbot December 2020",
"url": "https://success.trendmicro.com/en-US/solution/KA-0011282"
}
]
}Explicit source assertions (74)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03e7f671-763a-4027-af51-d01606c14a2a
Cyberint Qakbot May 2021 · NCC Group Black Basta June 2022 · Trend Micro Black Basta October 2022 · ATT QakBot April 2021 · Red Canary Qbot · Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0476f265-c79a-4ff7-a4cd-815d304818c6
Trend Micro Black Basta October 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05d8ec5a-0fc4-4037-913f-4d48e658ee9b
Trend Micro Qakbot May 2020 · ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cbe929a-96e2-4ff8-bf8d-501a9a8d2ad2
Crowdstrike Qakbot October 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0650
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ce8fbfc-10cf-4fd4-8314-5a3f184a986d
ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e90a4cd-b6b3-49c1-ae6d-b338ef7f9c3b
Red Canary Qbot · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fae3830-5845-414a-8429-b95745b3db32
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11475791-a127-476d-acaa-905e2397be5f
Group IB Ransomware September 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12362fa5-736b-4cac-9d74-51cd559f1e7c
Crowdstrike Qakbot October 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1343df30-b011-42f7-b3a3-a5d1d2f0b9c6
Crowdstrike Qakbot October 2020 · ATT QakBot April 2021 · ATT QakBot April 2021 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14a8d0df-a875-45ed-be76-c671c1771179
ATT QakBot April 2021ATTACK:enterprise:G1037 → uses → ATTACK:enterprise:S0650
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--219529c9-e3e3-4c73-b502-6782ddd7d26c
Latrodectus APR 2024ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--232c3c4a-8af5-404d-9b72-ac07b81c1b0e
Group IB Ransomware September 2020 · Trend Micro Qakbot May 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24566f69-12b6-4703-86e2-bbf966ac5535
NCC Group Black Basta June 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24e3a295-5894-48e0-b1d8-3c6e3df4de18
Trend Micro Qakbot May 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a864dfa-14df-4e58-98a6-62cbc14b52f9
Group IB Ransomware September 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b4bd264-4c8b-4303-9c54-113284c9e9a0
ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cb6835c-e6e6-46d5-b5d2-45846eac3b74
Crowdstrike Qakbot October 2020 · Group IB Ransomware September 2020 · Trend Micro Qakbot May 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e9e3384-b624-46aa-9a15-eff8eae2b6e1
Group IB Ransomware September 2020 · Red Canary QbotATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ef7ec01-8704-4c94-9949-c3239167f93b
Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f6ae8d7-29ee-4af6-9284-f698393ee1b7
Trend Micro Qakbot May 2020 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30e18b95-a311-4ab5-aa59-a31a20f65f66
ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3281ad27-8a05-4389-9438-f0ffce776346
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3655c6ae-38bf-4cd3-b229-b7e182fe6513
Crowdstrike Qakbot October 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2
Cyberint Qakbot May 2021 · ATT QakBot April 2021 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d8e97f7-9c58-47e1-b2c9-2cc55cca974f
Kaspersky QakBot September 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f8ae509-18e1-4189-9aa4-2ae649e56a88
Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--401790f5-abf5-4523-ac98-b200d3b34a7e
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--403e9797-7824-4840-87ad-b975023d9199
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Microsoft Ransomware as a Service · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020 · Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41c5b24c-6e33-43b4-ad7e-ebe7506d33b9
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--474912e8-0f81-439c-a613-51cbb9c0baa9
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a759577-622f-4ef0-bff1-ef047aa5a687
Trend Micro Black Basta October 2022 · Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4aec046b-4d53-44ea-97d0-e5a57290fb1e
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b70ec83-7488-4b4e-bd0b-58fb45da3a15
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5483bd88-4073-4fc9-93c8-eb45da7f4d97
Cyberint Qakbot May 2021 · Trend Micro Black Basta October 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d5a903f-d71f-42d5-941b-154d2e06ca78
Trend Micro Qakbot May 2020 · Crowdstrike Qakbot October 2020 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6004b82e-5860-4a5c-892e-775086598594
ATT QakBot April 2021 · Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--604fa5ae-0a32-45d7-9b9b-595fb43688b6
Cyberint Qakbot May 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--670efee1-b854-4d39-85b1-b6038e3580e3
Crowdstrike Qakbot October 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a1828c6-bba9-4285-a8af-5017b096252a
ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e311ecd-a80d-411b-aaef-ddc69749a8a8
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73ee6e9e-560a-42d1-8578-d5e59899dcf7
Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74eb5b40-3c37-49c3-ba39-63dd8f8b595a
Crowdstrike Qakbot October 2020 · Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Microsoft Ransomware as a ServiceATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f92fc3c-044c-4095-be4b-f6482a5619d1
Kroll Qakbot June 2020 · Kaspersky QakBot September 2021ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0650
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80800c66-bf13-4dc4-875e-04db77a12def
Microsoft Storm-1811 2024ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8235c444-415e-49ee-8ed9-10c24075be1f
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8879fdf1-552c-4e47-a60b-659ebf72772a
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--910d0f07-383b-480b-9637-d5b747353bdc
Kroll Qakbot June 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91fd8374-eeba-4243-a8de-ff7353236024
Kroll Qakbot June 2020 · Crowdstrike Qakbot October 2020 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1553.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a05a823c-de82-43ec-b235-4f09e0527811
Trend Micro Black Basta October 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a64c16bf-284e-4a74-a5c9-bcaee4d36313
Cyberint Qakbot May 2021 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8e662f8-e644-44d8-8aca-79e8d7924826
Cyberint Qakbot May 2021 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa444f15-777c-4bf6-819b-f03476d59401
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--add3bfcd-3e6d-4978-9e2c-ac6fad18fc5a
Trend Micro Qakbot May 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4cec817-37bb-4b1f-b165-26241efdcea0
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5e98443-7d3a-4a0a-975d-a5c1d564bd15
Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b82cbc8a-72b9-4f2b-a978-88b066a73cfb
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c039483a-5e0f-47be-b614-0d766eda9e0f
Group IB Ransomware September 2020 · Red Canary QbotATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c191afcc-515a-4f0c-85cc-15af0fd3674a
Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Microsoft Ransomware as a Service · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020 · Deep Instinct Black Basta August 2022ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6051e93-2d02-4890-bb0d-d0f3c8be8d15
Kaspersky QakBot September 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc3ca652-5f6f-4d8b-8b3d-51ab6f776e8a
Trend Micro Qakbot May 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4ee44c8-c389-4c02-8601-ee7c194d249e
Crowdstrike Qakbot October 2020 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d50a6bf2-266b-4770-809a-c1bf3e81305f
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Trend Micro Qakbot May 2020 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5be9ea1-7bf2-453b-bbca-19a9d82ea532
Crowdstrike Qakbot October 2020 · Group IB Ransomware September 2020 · Microsoft Ransomware as a Service · ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcda00f6-f5c1-412f-acb1-a431235fc6cc
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2a901d9-61a4-49df-8441-3ae622879cdf
ATT QakBot April 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e342ee2b-d7b6-4a48-a689-06a68efe589e
Group IB Ransomware September 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e88e3288-28c9-4ae3-93a7-45d0658eaff8
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e916bd35-cd90-4c1f-b600-aedffbf4de3c
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Red Canary Qbot · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea33531e-7a8f-45a1-a408-c8f405512aaa
Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Trend Micro Black Basta October 2022 · ATT QakBot April 2021 · Red Canary QbotATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea904c7f-f3a7-4e47-884f-bc13e38b09c6
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eaf2533c-e25e-4d4c-a7e5-62342a874bb1
Kaspersky QakBot September 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec62edb4-a463-46f8-82de-1a893caceb5e
Cyberint Qakbot May 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff2b5737-6a87-4ffb-b61a-89d8f21615b1
Crowdstrike Qakbot October 2020 · Group IB Ransomware September 2020 · ATT QakBot April 2021 · Kroll Qakbot June 2020