--- title: "Qakbot Spam Persistence, Air Europa Data Alert, Microsoft Anti-Spam Notification, Cybersecurity News [October 09, 2023] | DuoCircle" description: "Stay one step ahead with this Weekly Cybersecurity Bulletin, keeping you updated on the latest email security news, such as Qakbot Malware." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/" --- Quick Answer Four items shaped the week of October 9, 2023\. Qakbot spam campaigns continued despite the August takedown by US and international law enforcement, with researchers observing the same operators distributing Ransom Knight and Remcos through phishing, suggesting the infrastructure seizure left the human network intact. Air Europa disclosed a payment system breach and advised affected customers to cancel and reissue cards, with full card numbers and expiration dates exposed. Microsoft notified 365 administrators about the new Google and Yahoo bulk-sender requirements taking effect in February 2024, including SPF, DKIM, DMARC alignment, one-click unsubscribe, and a 0.3 percent spam complaint threshold. Researchers detailed Snake Keylogger campaigns harvesting saved credentials from browsers, capturing keystrokes, taking screenshots, and exfiltrating data over SMTP, FTP, and Telegram bots. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Qakbot%20Spam%20Persistence%2C%20Air%20Europa%20Data%20Alert%2C%20Microsoft%20Anti-Spam%20Notification%2C%20Cybersecurity%20News%20%5BOctober%2009%2C%202023%5D&url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F&title=Qakbot%20Spam%20Persistence%2C%20Air%20Europa%20Data%20Alert%2C%20Microsoft%20Anti-Spam%20Notification%2C%20Cybersecurity%20News%20%5BOctober%2009%2C%202023%5D "Share on Reddit") [ ](mailto:?subject=Qakbot%20Spam%20Persistence%2C%20Air%20Europa%20Data%20Alert%2C%20Microsoft%20Anti-Spam%20Notification%2C%20Cybersecurity%20News%20%5BOctober%2009%2C%202023%5D&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F "Share via Email") ![cybersecurity](https://media.mailhop.org/duocircle/images/2023/10/Office-365-migration.jpg) Stay one step ahead with this Weekly [Cybersecurity](/) Bulletin, **keeping you updated** on the latest email security news, such as Qakbot Malware, Microsoft 365 Email Security, Air Europa Data breach, and more. ## Qakbot Malware Spam Campaigns Persist Despite International Law Enforcement Crackdown Despite an international law enforcement operation targeting the **Qakbot malware**, [threat actors persist in their malicious activities](https://gbhackers.com/threat-actors-abusing-404-pages/). In late August, US and European authorities collaborated to disrupt the infamous Qakbot botnet, also known as Qbot and Pinkslipbot. The operation involved **seizing control** of Qakbot’s infrastructure, confiscating millions in cryptocurrency, and deploying a utility to remove the malware automatically. However, Talos [detected](https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/) that the email spamming campaign initiated by adversaries in early August was still active despite the law enforcement operation. These malicious actors use phishing emails to spread Ransom Knight ransomware and the Remcos backdoor. > Talos states that the crackdown likely only affected Qakbot’s Command and Control (C2) servers, leaving its **spam delivery infrastructure intact**. Reports indicate that the Qakbot infrastructure is already being reconstructed, with [malware operators](https://www.darkreading.com/attacks-breaches/darkgate-operator-skype-teams-messages-distribute-malware) gearing up to distribute new strains. ## Urgent Alert for Air Europa Customers: Data Breach Prompts Credit Card Cancellation Advice A significant data security incident recently affected Air Europa, Spain’s third-largest airline and a member of the SkyTeam alliance. This breach has urged customers to be **vigilant and respond** promptly. [![Cyber Attack Statistics](https://media.mailhop.org/duocircle/images/2023/10/DMARC-generator.jpg)](https://media.mailhop.org/duocircle/images/2023/10/DMARC-generator.jpg) An illicit intrusion into bank card records has compelled the airline to issue a cautionary alert to those impacted. This security [breach laid bare sensitive data](https://basketnews.com/news-195760-asvels-sensitive-data-breached-in-a-cyberattack.html), including card numbers, expiration dates, and the **3-digit CVV codes** from payment cards. _Air Europa swiftly strengthened its systems and reported the breach to the authorities, namely AEPD, INCIBE, and financial institutions._ The airline has **urged patrons to invalidate cards** used on their website to thwart potential card imitation and deceit. Customers were also reminded to abstain from divulging personal information or card PINs to [unfamiliar callers](https://interaksyon.philstar.com/politics-issues/2023/06/19/253918/one-ring-phone-scam-public-warned-not-to-answer-calls-from-unknown-numbers/) or email senders and to refrain from clicking on any dubious links regarding card transactions. Nonetheless, specifics such as the count of affected patrons, the breach occurrence date, and the discovery date **have not been disclosed**. Air Europa has abstained from issuing any additional statements about the event. It’s not the first time Air Europa has faced such a challenge. In 2021, the airline was fined [€600,000](https://gdprhub.eu/index.php?title=AEPD%5F-%5FPS/00179/2020) based on the General Data Protection Regulation (GDPR) of the European Union for **inadequate safeguards** and late reporting of a data breach affecting nearly 489,000 individuals. ## Microsoft 365 Administrators Notified About Recent Google Anti-Spam Regulations Microsoft 365 users received a cautionary note from Microsoft this week, urging them to **authenticate outgoing emails** in response to Google’s recent implementation of [stricter anti-spam protocols for bulk senders](https://www.bleepingcomputer.com/news/security/microsoft-365-admins-warned-of-new-google-anti-spam-rules/). The Microsoft Defender for Office 365 team emphasized the significance of [email authentication](/resources/email-authentication), stating that configuring it for your domain reduces the risk of emails being blocked as spam or rejected by providers like Gmail, Yahoo, AOL, and Outlook.com, especially crucial for **large-scale email campaigns**. Non-compliance with these authentication standards for [Microsoft 365](/email-security/latest-microsoft-updates-aimed-at-boosting-email-security/) email security, which includes using an effective tool like [Office 365 spam filter](/content/office-365-spam-filter), could potentially lead to emails being rejected or classified as spam. Microsoft has also [advised](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/outbound-spam-protection-about?view=o365-worldwide#recommendations-for-customers-who-want-to-send-mass-mailings-through-eop) against using Microsoft 365 for bulk emails, as emails breaching sending limits would either be blocked or directed to specialized [high-risk delivery pools](https://windowstechpro.com/what-is-high-risk-delivery-poolhrdp-in-exchange-online-protection/) by the integrated spam controls in **Exchange Online Protection (EOP)**. Instead, users opting for bulk emailing were encouraged to utilize their **on-premises email servers** or third-party mass mailing services, ensuring responsible email practices. This alert was sparked by Google’s announcement of new anti-spam guidelines, effective February 1, 2024\. These guidelines mandate senders of **over 5,000 daily emails** to Gmail users to implement [SPF](/content/sender-policy-framework)/[DKIM](/resources/what-is-dkim) and [DMARC](/resources/what-is-dmarc) email authentication. [![Anti-Spam](https://media.mailhop.org/duocircle/images/2023/10/spf-validator-7489.jpg)](https://media.mailhop.org/duocircle/images/2023/10/spf-validator-7489.jpg) ## Snake Keylogger: Uncovering its Theft of Login Credentials, Keystrokes, and Screen Capture Activities Researchers from Any.run [explored](https://cybersecuritynews.com/snake-keylogger-malware/) the complexities of an advanced keylogging program, “Snake,” adept at **acquiring sensitive information** such as login credentials, clipboard contents, typed keystrokes, and screenshots. Snake, alias **404 Keylogger**, initially surfaced in November 2020 as a .NET [infostealer malware](https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html). Operating with the help of FTP, SMTP, and Telegram, it seizes credentials and system details, employing a well-crafted email scam. One such email, originating purportedly from a Bolivian brokerage, lures recipients with a familiar Customs Clearing Agency and BMW logo. Once opened, the email prompts users to **download an attachment**, concealing the sinister ‘**pago 4094.exe**‘ file adorned with a Yahoo! Buzz icon. This file, though seemingly innocuous, stealthily infiltrates systems. Once executed, it silently [collects sensitive data](/data-privacy/intelbroker-threat-actors-steal-sensitive-data-of-11-million-weee-customers/), **remaining undetected**, a testament to its insidious design. Guarding against such threats requires a **multi-pronged approach**, using solutions such as Zero Trust Security, comprehensive [phishing awareness training](/phishing-awareness-training), robust endpoint protection, and advanced [email security tools](/email-security/ensure-confidentiality-of-your-emails-with-secure-email-gateways-and-end-to-end-encryption/). Implementing these strategies becomes imperative in safeguarding against the ever-evolving cyber threat landscape. ## Topics NewsSecurityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F) [ ](https://twitter.com/intent/tweet?text=Qakbot%20Spam%20Persistence%2C%20Air%20Europa%20Data%20Alert%2C%20Microsoft%20Anti-Spam%20Notification%2C%20Cybersecurity%20News%20%5BOctober%2009%2C%202023%5D&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-41-of-2023%2F) Copy Related Articles - [ ![spam](https://media.mailhop.org/duocircle/images/2021/07/sender-policy-framework-7535.jpg) Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam News ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/) - [ ![Cyber Security](https://media.mailhop.org/duocircle/images/2022/01/spf-flattening-7011.jpg) Cyber Security News Update, Week 1 of 2022 News ](/blog/announcements/cyber-security-news-update-week-1-of-2022/) - [ ![Cybersecurity](https://media.mailhop.org/duocircle/images/2023/01/spf-validator-6824.jpg) Cybersecurity News Update, Week 1 of 2023 News ](/blog/announcements/cyber-security-news-update-week-1-of-2023/) - [ ![cybersecurity](https://media.mailhop.org/duocircle/images/2024/01/phishing-protection.jpg) EasyPark Data Breach, Ohio Lottery Cyberattack, GTA 5 Leak, Cybersecurity News \[December 25, 2023\] News ](/blog/announcements/cyber-security-news-update-week-1-of-2024/) ## Related Articles [ News 3m Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[ News 6m Cyber Security News Update, Week 1 of 2022 Jan 7, 2022 ](/blog/announcements/cyber-security-news-update-week-1-of-2022/)[ News 7m Cybersecurity News Update, Week 1 of 2023 Jan 1, 2023 ](/blog/announcements/cyber-security-news-update-week-1-of-2023/)[ News 5m EasyPark Data Breach, Ohio Lottery Cyberattack, GTA 5 Leak, Cybersecurity News \[December 25, 2023\] Jan 4, 2024 ](/blog/announcements/cyber-security-news-update-week-1-of-2024/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Qakbot Spam Persistence, Air Europa Data Alert, Microsoft Anti-Spam Notification, Cybersecurity News [October 09, 2023]","description":"Stay one step ahead with this Weekly Cybersecurity Bulletin, keeping you updated on the latest email security news, such as Qakbot Malware.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/","datePublished":"2023-10-16T17:53:53.000Z","dateModified":"2025-05-15T13:25:32.000Z","dateCreated":"2023-10-16T17:53:53.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/"},"articleSection":"announcements","keywords":"News, Security, Updates","wordCount":794,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2023/10/Office-365-migration.jpg","caption":"cybersecurity","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Qakbot Spam Persistence, Air Europa Data Alert, Microsoft Anti-Spam Notification, Cybersecurity News [October 09, 2023]","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Qakbot Spam Persistence, Air Europa Data Alert, Microsoft Anti-Spam Notification, Cybersecurity News [October 09, 2023]","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Qakbot Spam Persistence, Air Europa Data Alert, Microsoft Anti-Spam Notification, Cybersecurity News [October 09, 2023]","description":"Stay one step ahead with this Weekly Cybersecurity Bulletin, keeping you updated on the latest email security news, such as Qakbot Malware.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/","datePublished":"2023-10-16T17:53:53.000Z","dateModified":"2025-05-15T13:25:32.000Z","dateCreated":"2023-10-16T17:53:53.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-41-of-2023/"},"articleSection":"announcements","keywords":"News, Security, Updates","wordCount":794,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2023/10/Office-365-migration.jpg","caption":"cybersecurity","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```