Qbot Archives - Security Affairs

Pierluigi Paganini April 17, 2023

New QBot campaign delivered hijacking business correspondence

Kaspersky researchers warn of a new QBot campaign leveraging hijacked business emails to deliver malware. In early April, Kaspersky experts observed a surge in attacks that QBot malware attacks (aka Qakbot, QuackBot, and Pinkslipbot). QBot has been active since 2008, it is used by threat actors for collecting browsing data and banking credentials, and other […]

Pierluigi Paganini December 15, 2022

Crooks use HTML smuggling to spread QBot malware via SVG files

Talos researchers uncovered a phishing campaign distributing the QBot malware to Windows systems using SVG files. Talos researchers uncovered a phishing campaign distributing the QBot malware using a new technique that leverages Scalable Vector Graphics (SVG) images embedded in HTML email attachments. HTML smuggling is a highly evasive technique for malware delivery that leverages legitimate HTML5 […]

Pierluigi Paganini June 18, 2020

An ongoing Qbot campaign targeted customers of tens of US banks

Researchers uncovered an ongoing campaign delivering the Qbot malware to steal credentials from customers of dozens of US financial institutions. Security researchers at F5 Labs have spotted ongoing attacks using Qbot malware payloads to steal credentials from customers of dozens of US financial institutions. Qbot, aka Qakbot, is a data stealer worm with backdoor capabilities that […]

Pierluigi Paganini April 08, 2020

Dark Nexus, a new IoT botnet that targets a broad range of devices

Cybersecurity researchers discovered a new IoT botnet, tracked as Dark Nexux, that is used to launch distributed denial-of-service (DDoS) attacks. Dark Nexux is the name of a new emerging IoT botnet discovered by Bitdefender that is used to launch DDoS attacks. The botnet spreads using exploits and launching credential stuffing attacks against a broad range […]

Pierluigi Paganini June 19, 2017

Pinkslipbot banking Trojan exploiting infected machines as control servers

Pinkslipbot banking Trojan is a banking Trojan that uses a complicated multistage proxy for HTTPS-based control server communication. Security researchers at McAfee Labs have spotted a new strain of the Pinkslipbot banking malware (also known as QakBot/QBot) that leverages UPnP to open ports, allowing incoming connections from anyone on the Internet to communicate with the infected […]

Pierluigi Paganini June 04, 2017

QakBot Banking malware causes massive Active Directory lockouts

Security experts at IBM noticed that hundreds to thousands of Active Directory users were locked out of their company’s domain by the QakBot Banking malware Malware researchers at IBM noticed that hundreds to thousands of Active Directory users were locked out of their organization’s domain, the incident is caused by the Qbot banking malware. The […]

Pierluigi Paganini April 14, 2016

The Qbot malware is back with new evasion techniques

Experts at BAE Systems revealed that the Qbot malware is back with new evasion techniques and very effective polymorphic capabilities. Security experts at BAE Systems revealed that the Qbot malware is back, they discovered 54,517 infected machines most of them located in the United States (85%). Qbot first appeared in 2009 when was detected by Symantec, […]

Pierluigi Paganini October 08, 2014

Northern Gold criminal gang infected half million PCs worldwide

Proofpoint firm uncovered a malicious campaign run by the Northern Gold criminal group which is targeting online banking users with a botnet of 500,000 PCs . Security experts at Proofpoint firm have identified a Russian-speaking cybercrime gang, dubbed Northern Gold, that has compromised more than 500,000 machines worldwide to steal users’ online credentials for major banks in the […]

Qbot

New QBot campaign delivered hijacking business correspondence

Crooks use HTML smuggling to spread QBot malware via SVG files

An ongoing Qbot campaign targeted customers of tens of US banks

Dark Nexus, a new IoT botnet that targets a broad range of devices

Pinkslipbot banking Trojan exploiting infected machines as control servers

QakBot Banking malware causes massive Active Directory lockouts

The Qbot malware is back with new evasion techniques

Northern Gold criminal gang infected half million PCs worldwide

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

Athlete or Hacker? Russian basketball player accused in U.S. ransomware case

U.S. CISA adds Citrix NetScaler ADC and Gateway flaw to its Known Exploited Vulnerabilities catalog

UK NCA arrested four people over M&S, Co-op cyberattacks

PerfektBlue Bluetooth attack allows hacking infotainment systems of Mercedes, Volkswagen, and Skoda

Qantas data breach impacted 5.7 million individuals

QUICK LINKS

Qbot

newsletter

Subscribe to my email list and stay up-to-date!

recent articles

Subscribe to my email list and stay
up-to-date!