Campaign, Jan 2023 to Dec 2023.View on attack.mitre.org
Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.
| Technique | Procedure example |
|---|---|
| T1059.003 Windows Command Shell |
Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe. |
| T1059.007 JavaScript |
Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives. |
| T1105 Ingress Tool Transfer |
Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory. |
| T1140 Deobfuscate/Decode Files or Information |
Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot. |
| T1204 User Execution |
Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation. |
| T1204.001 Malicious Link |
Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer. |
| T1204.002 Malicious File |
Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL. |
| T1218.011 Rundll32 |
Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant. |
| T1566.001 Spearphishing Attachment |
Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers. |
| T1589.002 Email Addresses |
Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations. |
MITRE does not attribute this campaign to a group.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
