Cybersecurity researchers spotted new QakBot activity targeting the hospitality industry last week.
According to a Saturday post on X (formerly Twitter) by CronUp cyber threat intelligence specialist Germán Fernández, the new attacks are characterized by low volume and have been traced back to a campaign labeled tchk06, Version 0x500.
Fernández identified a specific operational approach in which the malicious files advance through email, PDF, URL and MSI.
Notably, these harmful files are authenticated with the signature “SOFTWARE AGILITY LIMITED.” The PDF template employed in these attacks is identical to the one recently used by the PikaBot malware.
Tags:
No tags.
