News report # QakBot Malware Resurfaces with New Tactics, Targeting the Hospitality Industry The Hacker News, December 18, 2023. The first post-takedown QakBot activity: a phishing campaign identified by Microsoft Threat Intelligence that commenced on 11 December 2023 and targeted the hospitality sector, using a PDF from a sender impersonating an IRS employee.. **Source type:** News report **Published:** December 18, 2023 **Research grade:** S2 **Used in entries:** 1 ## Bibliographic record **Publisher:** The Hacker News **Published:** December 18, 2023 **Source type:** News report **Research grade:** Source grade S2 **Language:** English **Official record:** Not an official publication **Address:** [https://thehackernews.com/2023/12/qakbot-malware-resurfaces-with-new.html](https://thehackernews.com/2023/12/qakbot-malware-resurfaces-with-new.html) **What it supports:** The first post-takedown QakBot activity: a phishing campaign identified by Microsoft Threat Intelligence that commenced on 11 December 2023 and targeted the hospitality sector, using a PDF from a sender impersonating an IRS employee. **Dataset id:** src\_thehackernews\_qakbot\_resurfaces ## Research notes - By Ravie Lakshmanan. - The 2023-12-11 campaign start date is the resurgence date; 2023-12-18 is the article's publication date. How this source is used Cited 1 time across 1 record type. The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards. Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here. ## Cited by ### Later activity 1 citation Cited for activity recorded after the takedown. - [Qakbot continued operation](https://takedownindex.org/takedowns/operation-duck-hunt) Same operators, Operation Duck Hunt Later outcome [All sources](https://takedownindex.org/sources)