Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security

This report outlines QakBot’s long-term evolution and recent activity, describing new distribution techniques observed in 2022–2023 (notably .wsf-based phishing with ZIP attachments and OneNote-based delivery), payload execution behaviors (DLL dropped to C:\ProgramData and executed via rundll32.exe), and includes MQL detection rules and attack surface reduction recommendations to detect and hunt associated campaigns.