QakBot Trojan Revised to Lock You Out

Sometimes the old dogs just learn new tricks. In the case of the QakBot trojan, that is exactly what has happened. It’s been around since 2009, but it has a new trick up its sleeve. It now has the ability to cause IT administrators a lot of grief should it make its way onto the corporate network. That’s because, according to IBM X-Force, it can now lock out the Microsoft Active Directory system users in addition to the plethora of other annoying abilities it has always had.

QakBot is a worm that spreads through network shares and removable drives.  It can download files, steal information off infected machines, open a backdoor on the computer, and hide itself so that it cannot be detected. It can gather a doghouse-full of information such as login credentials to websites, cookie information, browser details, keystrokes, and geographic information, to name a few. In the latest case, it implements a “man in the browser” function that can allow malicious code to be inserted into online sessions. QakBot fetches the malicious scripts “on the fly” from a controlled domain rather than keeping those scripts inside its configuration file, according to X-Force. While it doesn’t actually infiltrate Active Directory, if the administrator credentials can be guessed, the malware will have the escalated privileges it needs to do other damage.

To help prevent this from happening in your organization, there are a few steps to take:

• Disable online advertisements from users’ views.
• Disable all macros by default.
• Configure domain accounts with the least amount of privilege that users need to do their jobs effectively.
• Create and enforce strong password policies. Require users to change passwords regularly. It’s recommended to do this quarterly.

Finally, train employees not to open attachments or click on links that arrive in email messages from unknown persons or if they are unexpected, regardless of whether or not they are familiar with the sender. This is the single best tactic to prevent malware from infiltrating your network.