QakBot and TA866 Used Malvertising and MSI Chains to Vet Victims

Researchers documented two financially motivated malware operations using multi-stage delivery chains built around JavaScript and MSI installers. One campaign linked to QakBot used search-engine pay-per-click malvertising and fake TeamViewer and Zoom installers, with redirect infrastructure including acehphonnajaya.com, homepagego.com, and bobforlacitycouncil.com, ultimately leading to an MSI payload hosted at richtools.info and 216.120.201.170. Analysis of the MSI found a QakBot stager with a modified configuration-decoding and C2 parsing routine, including an added flag field in C2 entries, suggesting the operators were testing or expanding malvertising as a delivery method.

Proofpoint separately tracked TA866 in a campaign dubbed Screentime, targeting organizations in the United States and Germany through email attachments and URLs routed via the 404 TDS traffic distribution system. Its infection chain also relied on a JavaScript downloader and MSI package, which installed a VBS downloader called WasabiSeed that maintained persistence and fetched additional payloads. TA866 distinguished itself by deploying a Screenshotter tool to capture victims’ desktops for manual triage before selectively delivering follow-on malware, including an AutoHotKey-based AHK Bot for Active Directory profiling and in-memory Rhadamanthys Stealer, highlighting a broader criminal trend of using staged MSI-based infections to qualify victims before deeper compromise.