Qakbot, the botnet known for its phishing campaigns and injection into legitimate Windows processes to avoid detection, has reappeared in a new campaign targeting the hospitality industry. On December 15, 2023, Microsoft made a series of posts on X, formerly known as Twitter, describing their findings which involve a threat actor using PDFs to distribute the malware. This is despite Operation Duck Hunt, a multinational effort to bring down the Qakbot network and infrastructure, that was successfully executed earlier this year. Microsoft reported that threat actors are attempting to masquerade as IRS employees and distribute the Qakbot malware via malicious files through this new round of phishing. When the victim attempts to access the PDF, it will instead prompt them to download it for proper viewing which will actually download a “.msi” Windows installer file. Once executed, this file will install the Qakbot malware DLL onto the device. According to Microsoft, the DLL was generated on December 11th, which is the same day that the new phishing campaign began. Microsoft and other researchers have stated that there are some minor differences between the older versions of Qakbot and this latest attempt at its revival, indicating that someone is still working on this malware. One of the more notable changes is the use of AES to decrypt identified strings instead of XOR that was previously used. CTIX analysts will continue to monitor the situation with the new Qakbot campaign to identify any new developments and information.