Loading story…
Security researchers detailed multiple ways to identify QakBot command-and-control infrastructure, combining packet analysis, internet-wide scanning, and large-scale network telemetry. One analysis of a QakBot infection PCAP identified concrete indicators including multiple C2 endpoints, a proxy IP and port, JA3/JA3S TLS fingerprints, certificate details, and web-response artifacts that can support detection and investigation. A separate hunt using Censys started from a ThreatFox-tagged server and used regular expressions on TLS subject_dn and issuer_dn fields to reduce a broad dataset to 83 likely QakBot servers, with an optional banner-hash filter narrowing the set further.
Team Cymru’s telemetry from January through May 2023 showed that active victim-facing QakBot C2 nodes frequently communicated over TCP/443 with three upstream Tier 2 servers in Russia, and that infrastructure used by the most active affiliate campaigns was not cleanly separated by affiliate ID. The researchers also found that older C2 servers continued talking to backend systems after campaign activity declined, suggesting persistent management of the botnet, while many active bot C2 nodes appeared to be compromised hosts concentrated in India and likely sourced through third-party brokers. Together, the findings give defenders practical hunting opportunities around shared TLS characteristics, known C2 indicators, and outbound connections from infected hosts to upstream Russian servers.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
A researcher published a method for identifying likely QakBot servers in Censys by pivoting from a ThreatFox-tagged server at 74.12.147.243:2222 and filtering on shared TLS certificate subject and issuer patterns. The approach reduced a broad result set to 83 candidate servers, with an optional empty-banner filter narrowing it to 49.
Team Cymru published an analysis showing that QakBot C2 servers used by the Obama and BB affiliate campaigns communicated with the same three upstream Tier 2 servers in Russia over TCP/443, indicating the infrastructure was not cleanly separated by affiliate ID. The post also released a large IOC list of confirmed QakBot bot C2 servers and recommended hunting via outbound connections to the Russian Tier 2 nodes.
In early May 2023, RU2 and RU3 resumed activity after their late-April lull, and Team Cymru observed TCP/443 communications from QakBot C2 servers spike to roughly twice prior levels.
From 2023-04-21 to 2023-05-01, Team Cymru observed RU2 and RU3 as nearly inactive, while traffic volume to RU1 surged during that period.
On 2023-04-19, older QakBot C2 servers that had been quiet toward RU1 resumed communications with that upstream server, ending the roughly three-week gap observed by Team Cymru.
Team Cymru used April 2023 QakBot configuration data to confirm that the same three upstream Tier 2 servers in Russia remained in place across campaigns.
In early April 2023, QakBot C2 servers associated with Obama campaigns primarily communicated with RU2 and RU3, but Team Cymru also observed a few interactions with RU1.
A Netresec analysis of a QakBot infection PCAP identified concrete network indicators, including C2 endpoints 80.47.61.240:2222 and 185.80.53.210:443, proxy 23.111.114.52:65400, TLS fingerprints, certificate details, and web-response hashes for detection and investigation.
Team Cymru observed that older confirmed or high-confidence QakBot C2 servers stopped communicating with the RU1 upstream server for about three weeks from late March through April 2023, while April campaign C2s continued using RU1.
Around the second week of March 2023, all three Russian Tier 2 QakBot servers showed increased activity from India- and US-located C2 IPs and reduced geolocation diversity, according to Team Cymru telemetry.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 280 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
embee-research.ghost.io
Open sourceteam-cymru.com
Open sourcenetresec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzing **QakBot v5.0** reported that the long-running malware family has added support for **64-bit Windows** while preserving its role as a modular loader and information stealer. The examined sample, a 64-bit DLL seen in the wild in early February 2024, uses layered anti-analysis techniques including sandbox, emulator, process, and virtual machine checks, and relies on **CRC32-based API hashing** with an added XOR layer to obscure functionality. Analysts also found updated string handling in which an encrypted `xor_key_blob` is first decrypted before being used to recover embedded strings tied to execution paths, persistence, WMI queries, virtualization detection, security-product checks, and command execution. The malware stores configuration data in the `.data` section and protects it with **AES-based encryption**, while its command-and-control traffic is sent over **HTTP** using AES-encrypted, Base64-encoded payloads. Recovered configuration details included the QakBot ID **`tchk08`**, flag **`40=1`**, and a timestamp of **2024-01-31 21:22:34**; analysts also extracted C2 endpoints at **`31.210.173.10:443`**, **`185.156.172.62:443`**, and **`185.113.8.123:443`**. Beyond communications, QakBot v5.0 performs extensive host reconnaissance through WMI, Windows APIs, and shell commands, supports process hollowing, and maintains persistence through registry entries or scheduled tasks, underscoring its continued evolution as a stealthy post-compromise platform.
Aug 15, 2026
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026
Qakbot operators repeatedly changed their intrusion chains between March and May 2023, using malspam and a rotating set of attachment and container formats including **PDF**, **HTML**, **ZIP**, **OneNote**, **WSF/HTA**, and **XLL** files to deliver the malware. Researchers observed HTML smuggling, obfuscated JavaScript, PowerShell, and DLL-based payload staging in March, followed by ZIP-to-XLL chains that rebuilt payloads from split `DAT` files and created scheduled tasks for persistence. By April and May, the malware’s operators had shifted from base64-encoded PowerShell toward hex-encoded `XMLHTTP` requests delivered through WSF files, and used a OneNote-to-MSI lure posing as a Microsoft Azure installer. Later campaigns added stronger defense evasion, including indirect command execution through **`conhost.exe`**, DLL side-loading, and `curl`-based payload retrieval. Researchers also noted that **Pikabot** samples seen in mid-May shared similar tradecraft, but said the available evidence did not support attributing both malware families to the same actor.
Aug 15, 2026