In a comprehensive exploration of the PikaBot malware, this advisory delves into the insidious capabilities and techniques employed by this emerging malicious backdoor. Since its onset in early 2023, PikaBot has posed a significant threat by providing unauthorized remote access to compromised systems. This article elucidates the multifaceted nature of PikaBot's operations, from its distribution methods to the execution of malicious activities. As the intricacies of PikaBot's functionalities are dissected, attention is drawn to its parallelism with the dismantled QakBot trojan, shedding light on the evolving landscape of cyber threats. Additionally, the advisory provides valuable insights into the historical context of QakBot and its connection to the cybercriminal group TA577, OBRELA’S findings regarding new overlapping techniques of QakBot and PikaBot and offering recommendations to fortify digital security against such potent threats.
PikaBot, an emerging malicious backdoor, has been actively compromising systems since early 2023, providing unauthorized remote access to the attackers. This insidious threat is equipped to receive commands from a command-and-control server, allowing for the injection of arbitrary shellcode, DLLs, or executable files. Notably, PikaBot employs robust anti-vm and anti-debug techniques. Its malicious capabilities extend to distributing CobaltStrike, ransomware, and various other types of malicious software. Comprising a loader and a core module, the latter executes the majority of the malware's functions, while the former facilitates these malicious activities.
In terms of initial access, PikaBot distributors employ email thread hijacking, intercepting legitimate email conversations to insert malicious attachments or URLs. The recent PikaBot & Darkgate campaign, reported by Cofense, starting from October 2023, exploited the Microsoft Exchange Server vulnerability ProxyLogon CVE-2021-26855. This allowed threat actors to bypass authentication, impersonate admins, and hijack existing email threads. Email thread hijacking proves highly effective, as users are often not warned that a phishing email may originate from within existing threats.
For execution, victims are enticed to open ZIP attachments or download and open them via embedded URLs, which have additional layers restricting access to the malicious payload based on specific threat actor-defined requirements (i.e. location specific-excluding infecting machines in Commonwealth of Independent States which were members of the former Soviet Union and internet browser specific). The ZIP archive contains JS files, leveraging JavaScript applications to connect to another URL and download and run PikaBot or DarkGate malware.
PikaBot prioritizes defense evasion, incorporating sophisticated anti-debugging and anti-VM measures inspired by the Al-Khaser project. The loader component runs anti-analysis tests, employing steganography to conceal its payload. In case of test failure, Pikabot aborts execution, thwarting research analysis. Its anti-analysis techniques include checking for debuggers, breakpoints, and system information, utilizing tools like ADVobfuscator for string obfuscation, and employing methods to detect sandbox environments and analysis attempts.
In terms of command and control (C2), PikaBot employs a proprietary C2 framework, supporting a variety of commands for host enumeration and advanced secondary payload injection. These commands range from running shell commands to fetching and executing EXE or DLL files, altering the C2 check-in interval, and even a "destroy" command.
PikaBot's objectives pose extreme dangers, including crypto-mining on compromised systems, installing spyware and ransomware, stealing credentials and confidential data, and enabling remote hands-on control.
Remarkably intriguing is the parallelism between Pikabot and the recently dismantled QakBot trojan, encompassing distribution methods, campaigns, and malware behaviors. Despite the FBI's announcement on August 29 about the disruption of the QakBot botnet infrastructure through international law enforcement coordination, the relentless nature of cybersecurity ensures that new threats emerge to fill the void left by dismantled networks.
Cofense brought attention to a fresh malware phishing campaign disseminating DarkGate and PikaBot, as mentioned earlier. Although there is no conclusive evidence linking DarkGate and PikaBot to QakBot, the cybersecurity community notes substantial similarities. Furthermore, PikaBot surfaced just as QakBot activity ceased, suggesting a potential connection. In a mimicry of QakBot’s tactics, the perpetrators behind this campaign employ identical techniques, indicating either the involvement of cybercriminals affiliated with QakBot or the inspiration of another group or groups by the recently dismantled criminal network.
The shared techniques between QakBot and PikaBot include:
Historically, the cybercriminal group TA577, also known as Storm-0464, DEV-0464, Hive0118, and TR, has been observed distributing QakBot. This prolific financially motivated access broker is notorious for disseminating QakBot and facilitating access for hands-on-keyboard ransomware operators like Storm-0506, Storm-0216, and Storm-0826, who deploy the Black Basta ransomware. Storm-0464 has also distributed other malware, such as SquirrelWaffle and recently PikaBot. While the group's geographical origin remains unconfirmed, it has targeted a diverse range of industries and regions, exploiting vulnerabilities like the Microsoft Support Diagnostic Tool (CVE-2022-30190), ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065), and ProxyShell (CVE-2021-31207, CVE-2021-34473, and CVE-2021-34523) as part of its operations.
In the past OBRELA SOC teams have also identified overlapping Tactics, Techniques and Procedures (TTPs) of QakBot and PikaBot. For example:
1.Incident QakBot – March 2023:
In this detected incident the initial access vector was a hijacked email thread in which the threat actor attached a password-protected ZIP file that upon the victim opened it and clicked the embedded JS file, the following process tree was identified:
This command fetches a DLL file from a remote server, stores it in the Temp folder and then runs it via Rundll32.
2. Incident PikaBot – October 2023:
In this detected incident the victim opened a served ZIP file and clicked the embedded JS file. The following process tree was identified:
This command, beside other actions that it performs, also fetches a DLL file from a remote server, stores it in the Temp directory and then executes it via rundll32.
By comparing these 2 incidents, we can also confirm the assumptions of technique overlapping between QakBot and PikaBot, since they both utilize a ZIP file that contain embedded JS files that upon executing, they spawn CMD/PowerShell processes to fetch a DLL file, store it in the Temp directory and then execute it via rundll32.
In addition, Obrela has identified also another technique overlap between the two malwares by detecting a recent PikaBot incident:
3. 2nd Incident PikaBot – December 2023:
In this newly detected incident, the initial access vector was a hijacked email thread in which the threat actor included a malicious URL. Upon gaining trust, the victim clicked on the link, downloaded, and opened a suspicious ZIP file and clicked the embedded JS file. The following process tree was identified:
In this incident, the initial access vector is the same as for both QakBot & PikaBot (hijacked email threads), delivering a malicious ZIP file that includes JS files that fetch a file from a remote server and then execute it via Rundll32.
However, in this incident the following points were substantially different from previous encounters, indicating the usage of more sophisticated means of obfuscation:
In the past, QakBot has also been observed performing similar techniques:
Thus, we can also observe here a new overlap in the TTPs of the 2 malwares.
Credits to the Detection Engineering, SOC, and CTI teams of OBRELA Security Industries SA.