Latest QakBot news

Microsoft fixes Windows zero-day exploited in QakBot malware attacks

Microsoft has fixed a zero-day vulnerability exploited in attacks to deliver QakBot and other malware payloads on vulnerable Windows systems.
- Sergiu Gatlan
- May 14, 2024
- 02:18 PM
- 0
New Qbot malware variant uses fake Adobe installer popup for evasion

The developer of Qakbot malware, or someone with access to the source code, seems to be experimenting with new builds as fresh samples have been observed in email campaigns since mid-December.
- Bill Toulas
- February 15, 2024
- 08:27 AM
- 0
Qbot malware returns in campaign targeting hospitality industry

The QakBot malware is once again being distributed in phishing campaigns after the botnet was disrupted by law enforcement over the summer.
- Lawrence Abrams
- December 17, 2023
- 10:09 AM
- 0
DarkGate and Pikabot malware emerge as Qakbot’s successors

A sophisticated phishing campaign pushing the DarkGate malware infections has recently added the PikaBot malware into the mix, making it the most advanced phishing campaign since the Qakbot operation was dismantled.
- Bill Toulas
- November 21, 2023
- 10:55 AM
- 0
How the FBI nuked Qakbot malware from infected Windows PCs

The FBI announced today the disruption of the Qakbot botnet in an international law enforcement operation that not only seized infrastructure but also uninstalled the malware from infected devices.
- Lawrence Abrams
- August 29, 2023
- 04:45 PM
- 4
Qakbot botnet dismantled after infecting over 700,000 computers

Qakbot, one of the largest and longest-running botnets to date, was taken down following a multinational law enforcement operation spearheaded by the FBI and known as Operation 'Duck Hunt.'
- Sergiu Gatlan
- August 29, 2023
- 12:54 PM
- 2
QBot malware abuses Windows WordPad EXE to infect devices

The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.
- Lawrence Abrams
- May 27, 2023
- 11:12 AM
- 2
How to prevent Microsoft OneNote files from infecting Windows with malware

The seemingly innocuous Microsoft OneNote file has become a popular file format used by hackers to spread malware and breach corporate networks. Here's how to block malicious OneNote phishing attachments from infecting Windows.
- Lawrence Abrams
- March 05, 2023
- 03:23 PM
- 12
New attacks use Windows security bypass zero-day to drop malware

New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings.
- Lawrence Abrams
- November 19, 2022
- 01:28 PM
- 0
QBot phishing abuses Windows Control Panel EXE to infect devices

Phishing emails distributing the QBot malware are using a DLL hijacking flaw in the Windows 10 Control Panel to infect computers, likely as an attempt to evade detection by security software.
- Lawrence Abrams
- November 17, 2022
- 01:19 PM
- 0
QBot phishing uses Windows Calculator DLL hijacking to infect devices

The operators of the QBot malware have been using a DLL hijacking flaw in Windows Calculator to infect computers, which also helps evade detection by security software.
- Bill Toulas
- July 24, 2022
- 11:18 AM
- 0
QBot now pushes Black Basta ransomware in bot-powered attacks

The Black Basta ransomware gang has partnered with the QBot malware operation to spread laterally through hacked corporate environments.
- Bill Toulas
- June 06, 2022
- 05:01 PM
- 0
Lockean multi-ransomware affiliates linked to attacks on French orgs

Details about the tools and tactics used by a ransomware affiliate group, now tracked as Lockean, have emerged today in a report from France's Computer Emergency Response Team (CERT).
- Ionut Ilascu
- November 04, 2021
- 07:22 AM
- 0
Spammers use Squirrelwaffle malware to drop Cobalt Strike

A new malware threat named Squirrelwaffle has emerged in the wild, supporting actors with an initial foothold and a way to drop malware onto compromised systems and networks.
- Bill Toulas
- October 26, 2021
- 03:45 PM
- 1
QBot malware is back replacing IcedID in malspam campaigns

Malware distributors are rotating payloads once again, switching between trojans that are many times an intermediary stage in a longer infection chain.
- Ionut Ilascu
- April 13, 2021
- 11:38 AM
- 0
Qbot malware switched to stealthy new Windows autostart method

A new Qbot malware version now activates its persistence mechanism right before infected Windows devices shutdown and it automatically removes any traces when the system restarts or wakes up from sleep.
- Sergiu Gatlan
- December 09, 2020
- 04:00 PM
- 0
QBot partners with Egregor ransomware in bot-fueled attacks

The Qbot banking trojan has dropped the ProLock ransomware in favor of the Egregor ransomware who burst into activity in September.
- Lawrence Abrams
- November 20, 2020
- 05:00 AM
- 0
QBot phishing lures victims using US election interference emails

The Qbot botnet is now spewing U.S. election-themed phishing emails used to infect victims with malicious payloads designed to harvest user data and emails for use in future campaigns.
- Sergiu Gatlan
- November 04, 2020
- 06:18 PM
- 0
QBot uses Windows Defender Antivirus phishing bait to infect PCs

The Qbot botnet uses a new template for the distribution of their malware that uses a fake Windows Defender Antivirus theme to trick you into enabling Excel macros.
- Lawrence Abrams
- October 12, 2020
- 03:50 PM
- 0
The most common malicious email attachments infecting Windows

To stay safe online, everyone needs to recognize malicious attachments that are commonly used in phishing emails to distribute malware.
- Lawrence Abrams
- October 11, 2020
- 01:18 PM
- 4