Researchers have observed the continuance of a phishing campaign linked to the QakBot threat actors despite law enforcement’s disruption to its infrastructure in late August 2023. The threat actors’ phishing campaign has been ongoing since as early as August 2023 and associated with “Ransom Knight” (otherwise known as “Cyclops”) ransomware as well as the “Remcos” remote access trojan (RAT). The seizure of the infrastructure and cryptocurrency caused significant damages to the group’s operations, and while there is no evidence that the threat actors have distributed their malware loader since the infrastructure takedown, it seems as though the attempted disruption only impacted their command-and-control (C2) servers while leaving their spam delivery infrastructure unaffected. The Ransom Knight malware still poses a threat even while the C2 server is down and based on the threat actors remaining active post-takedown, they may be choosing to rebuild their infrastructure to resume full capabilities. Activity associated with the group before the takedown consisted primarily of phishing emails containing malicious LNK files that begin the infection and likely deploy Ransom Knight ransomware. Beyond the LNK files stored within the ZIP archive, an additional file has been identified that likely propagates the Remcos RAT, which facilitates persistent backdoor access to the endpoints. Researchers have also observed file names written in Italian, which may point to Italy as the target region for this threat actor. CTIX analysts will continue to monitor QakBot activity and provide additional QakBot campaign details when available.