DocuSign Malspam Delivers Qakbot and Leads to Cobalt Strike
released on 2021-03-03 @ 06:25:08 PM
On Tuesday 2021-03-02, security researcher Brad Duncan (@malware_traffic) generated a QakBot (Qbot) infection, from DocuSign malspam, on a Windows host in an Active Directory (AD) test environments, which led post infection Cobalt Strike activity as a follow up.