Windows 10: Mitigating and eliminating Qakbot and Emotet in corporate networks

Brink · Nov 6, 2017

The threat to information is greater than ever, with data breaches, phishing attacks, and other forms of information theft like point-of-sale malware and ATM hacks becoming all too common in today's threat landscape. Information-stealing trojans are in the same category of threats that deliver a steady stream of risk to data and can lead to significant financial loss.

Qakbot and Emotet are information stealers that have been showing renewed activity in recent months. These malware families are technically different, but they share many similarities in behavior. They both have the ultimate goal of stealing online banking credentials that malware operators can then use to steal money from online banking accounts. They can also steal other sensitive information using techniques like keylogging.

Figure 1. Qakbot and Emotet monthly machine encounters show an upward trend. This data doesn’t include Qakbot and Emotet variants blocked by automation and cloud rules.

Even though these malware families are typically known to target individual online banking users, more and more enterprises, small and medium businesses, and other organizations have been affected by indiscriminate infections.

Figure 2. Breakdown of Qakbot and Emotet machine encounters

Recent variants of these malware families have spreading capabilities, which can increase the chances of multiple infections in corporate networks. They can also be spread by other malware during the lateral movement stage of a cyberattack.

Typical Qakbot and Emotet kill chain

Over the years, the cybercriminals behind Qakbot and Emotet have improved the code behind their malware. They have evolved to evade detection, stay under the radar longer, and increase the chances of spreading to other potential victims.
We mapped some of the common behaviors we’ve seen in Qakbot and Emotet variants and see a lot of similarities.

Figure 3. Qakbot and Emotet attack kill chain. Note that some Qakbot and Emotet variants might not exhibit all of the behaviors above and might be capable of unique routines.

Because of similarities in behavior, Qakbot and Emotet can be mitigated by similar security measures.
Click to expand...

Read more: Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks Windows Security blog

:)

rolcusa100 · Nov 6, 2017

Removing and or eliminating windows defender notifications

I'm using other virus software instead of windows defender and the notification is popping up every few seconds stating neither defender nor forticlient is on which is far from the truth. How do I either stop the notifications from windows defender
or permanently remove this ignoring virus software defender. I currently have windows defender turned off and it is a nuisance with these notifications. I had the same problem when I had Stopzilla AV software but not as bad as now. Windows defender does
not play nice when other AV software is loaded.

JakeAzachi · Nov 6, 2017

Nokia icon 929 keeps showing wifi from previous locations but not current

I have the same problem with one exception. I still show my office wifi network available not my home when I am at home.

My mitigation was to click any of the "left over" wifi networks. Once it cannot connect my home network appears.

Microsoft, please note, I have used the recover tool many times and have had no mitigation to this problem with the exception of my work around.

Windows 10: Mitigating and eliminating Qakbot and Emotet in corporate networks

Mitigating and eliminating Qakbot and Emotet in corporate networks

Mitigating and eliminating Qakbot and Emotet in corporate networks

Mitigating and eliminating Qakbot and Emotet in corporate networks - Similar Threads - Mitigating eliminating Qakbot

Microsoft RRAS as an entry point to the corporate network

Microsoft RRAS as an entry point to the corporate network

BSOD mitigation

BSOD mitigation

BSOD mitigation

Unable to access Windows RDP via corporate network

Security Mitigations

Security Mitigations

Spectre mitigations in MSVC