The Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
summary
Qakbot increasingly uses Microsoft OneNote files that embed JavaScript, VBScript or DLL entry stubs to bypass Protected View and deliver staged payloads; analysts extract embedded objects, use emulation with dumpulator and Unicorn to dump unpacked memory, RC4-decrypt the configuration and recover lists of CNC IP:port and sample IDs. Telemetry shows about 100,000 detections worldwide through June 2023; law enforcement seized infrastructure tied to roughly 700,000 infected devices and $8M in crypto. Defenses focus on behavioral detection, blocking unusual attachments and disabling unnecessary scripting.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:40Threat intelligence fundamentals
- 5:10OneNote malware campaigns
- 9:32Malware analysis techniques
- 11:40Automating malware pipeline
- 14:10Case study QuakBot analysis
- 19:10Dumpulator for malware emulation
- 22:47QuakBot config decryption
- 23:50QuakBot global heatmap
- 25:39Takedowns and threat evolution
- 27:12Detection prevention strategies
- 28:15Conclusion
related talks
52mRansomware 101: Get Smart Understanding Real Attacks
31mHacking People’s Mind: When Threat Actors Master Social Engineering
42mKeynote: The Expanding Universe of Cyber Threats
31mThe Wolves Among Us… A Tale of APT’s Thievery
49mThe State Of Malware From The Eye Of The Tiger
42mStart Covering Your Bases And Stop Chasing APT Headlines
41m"Revenge of The Script Kiddies: Current Day Uses..."
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...