QBot: Laying the Foundations for Black Basta Ransomware Activity

ReliaQuest observed an incident where a phishing email using HTML smuggling delivered a password-protected ZIP/ISO which executed a QBot infection; the adversary harvested credentials (DPAPI/Mimikatz), leveraged a service account in the Domain Admins group to move laterally and deploy Cobalt Strike beacons (C2: 194.165.16.95), and installed remote-access tools (AnyDesk, Atera, Splashtop). The activity—attributed to a likely Black Basta affiliate—exhibited fast breakout (77 minutes), defense-evasion (ISO/ZIP obfuscation, process injection, pass-the-hash/overpass-the-hash), and use of common post-exploitation tools; the report provides MITRE TTP mappings, IOCs, and recommendations to improve logging and detection.