Latest Qbot news

Microsoft fixes Windows zero-day exploited in QakBot malware attacks

Microsoft has fixed a zero-day vulnerability exploited in attacks to deliver QakBot and other malware payloads on vulnerable Windows systems.
- Sergiu Gatlan
- May 14, 2024
- 02:18 PM
- 0
New Qbot malware variant uses fake Adobe installer popup for evasion

The developer of Qakbot malware, or someone with access to the source code, seems to be experimenting with new builds as fresh samples have been observed in email campaigns since mid-December.
- Bill Toulas
- February 15, 2024
- 08:27 AM
- 0
Qbot malware returns in campaign targeting hospitality industry

The QakBot malware is once again being distributed in phishing campaigns after the botnet was disrupted by law enforcement over the summer.
- Lawrence Abrams
- December 17, 2023
- 10:09 AM
- 0
How the FBI nuked Qakbot malware from infected Windows PCs

The FBI announced today the disruption of the Qakbot botnet in an international law enforcement operation that not only seized infrastructure but also uninstalled the malware from infected devices.
- Lawrence Abrams
- August 29, 2023
- 04:45 PM
- 4
Qakbot botnet dismantled after infecting over 700,000 computers

Qakbot, one of the largest and longest-running botnets to date, was taken down following a multinational law enforcement operation spearheaded by the FBI and known as Operation 'Duck Hunt.'
- Sergiu Gatlan
- August 29, 2023
- 12:54 PM
- 2
QBot malware abuses Windows WordPad EXE to infect devices

The QBot malware operation has started to abuse a DLL hijacking flaw in the Windows 10 WordPad program to infect computers, using the legitimate program to evade detection by security software.
- Lawrence Abrams
- May 27, 2023
- 11:12 AM
- 2
New QBot email attacks use PDF and WSF combo to install malware

QBot malware is now distributed in phishing campaigns utilizing PDFs and Windows Script Files (WSF) to infect Windows devices.
- Lawrence Abrams
- April 17, 2023
- 09:48 AM
- 5
New QakNote attacks push QBot malware via Microsoft OneNote files

A new QBot malware campaign dubbed "QakNote" has been observed in the wild since last week, using malicious Microsoft OneNote' .one' attachments to infect systems with the banking trojan.
- Bill Toulas
- February 07, 2023
- 05:21 PM
- 0
Attackers use SVG files to smuggle QBot malware onto Windows systems

QBot malware phishing campaigns have adopted a new distribution method using SVG files to perform HTML smuggling that locally creates a malicious installer for Windows.
- Bill Toulas
- December 14, 2022
- 02:13 PM
- 0
Microsoft patches Windows zero-day used to drop ransomware

Microsoft has fixed a security vulnerability used by threat actors to circumvent the Windows SmartScreen security feature and deliver Magniber ransomware and Qbot malware payloads.
- Sergiu Gatlan
- December 14, 2022
- 01:24 PM
- 0
New attacks use Windows security bypass zero-day to drop malware

New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings.
- Lawrence Abrams
- November 19, 2022
- 01:28 PM
- 0
QBot phishing abuses Windows Control Panel EXE to infect devices

Phishing emails distributing the QBot malware are using a DLL hijacking flaw in the Windows 10 Control Panel to infect computers, likely as an attempt to evade detection by security software.
- Lawrence Abrams
- November 17, 2022
- 01:19 PM
- 0
QBot phishing uses Windows Calculator DLL hijacking to infect devices

The operators of the QBot malware have been using a DLL hijacking flaw in Windows Calculator to infect computers, which also helps evade detection by security software.
- Bill Toulas
- July 24, 2022
- 11:18 AM
- 0
Malicious Windows 'LNK' attacks made easy with new Quantum builder

Malware researchers have noticed a new tool that helps cybercriminals build malicious .LNK files to deliver payloads for the initial stages of an attack.
- Bill Toulas
- June 23, 2022
- 11:04 AM
- 0
The Week in Ransomware - June 10th 2022 - Targeting Linux

It has been relatively quiet this week with many companies and researchers at the RSA conference. However, we still had some interesting ransomware reports released this week.
- Lawrence Abrams
- June 10, 2022
- 06:18 PM
- 1
Qbot malware now uses Windows MSDT zero-day in phishing attacks

A critical Windows zero-day vulnerability, known as Follina and still waiting for an official fix from Microsoft, is now being actively exploited in ongoing phishing attacks to infect recipients with Qbot malware.
- Sergiu Gatlan
- June 07, 2022
- 06:03 PM
- 0
QBot now pushes Black Basta ransomware in bot-powered attacks

The Black Basta ransomware gang has partnered with the QBot malware operation to spread laterally through hacked corporate environments.
- Bill Toulas
- June 06, 2022
- 05:01 PM
- 0
Qbot malware switches to new Windows Installer infection vector

The Qbot botnet is now pushing malware payloads via phishing emails with password-protected ZIP archive attachments containing malicious MSI Windows Installer packages.
- Sergiu Gatlan
- April 11, 2022
- 04:58 PM
- 0
Qbot, Lokibot malware switch back to Windows Regsvr32 delivery

Malware distributors have turned to an older trick known as Squiblydoo to spread Qbot and Lokibot via Microsoft Office document using regsvr32.exe.
- Bill Toulas
- February 10, 2022
- 11:25 AM
- 0
Qbot needs only 30 minutes to steal your credentials, emails

The widespread malware known as Qbot (aka Qakbot or QuakBot) has recently returned to light-speed attacks, and according to analysts, it only takes around 30 minutes to steal sensitive data after the initial infection.
- Bill Toulas
- February 08, 2022
- 03:12 AM
- 0