Thursday, March 28, 2024

QBot Trojan Attacks Victims with Malicious Election Interference Attachments

QBot malware, also referred to as Qakbot and Pinkslipbot, is a banking Trojan active since 2008. Attackers are using the QBot malware with updated worm features to steal users’ keystrokes, deploy backdoors, and spread malware payloads on compromised devices.

Researchers stated that the newest version of QBot has detection and research-evasion techniques that hide the malware codes and shake scanners and anti-software tools.

As U.S. election night ended, uncertainty regarding the results began to sneak in, threat actors decided to leap in thereon too. In observation, a new spam campaign delivering malicious attachments that exploit doubts about the election process.

The QBot banking Trojan operators return also with the U.S. election-themed phishing emails enticing victims with malicious election interference attachments.

Hijacked Email Threads Pushing False DocuSign Documents

The malicious emails come as thread replies, almost like what Emotet (Trojan that is primarily spread through spam emails) does to add legitimacy and make detection harder.

They contain zip attachments suitably named ElectionInterference_[8 to 9 digits](.)zip(as shown within the image below).

Phishing Email

While the election results are still being assessed and debated, victims are tempted to open up the document to examine alleged election interference.

The extracted file is an Excel spreadsheet (as shown below) disguised as a secure DocuSign file allegedly containing information associated with election interference. When the potential victims open bait documents, they are tricked to permit macros to ‘decrypt’ the document.

Malicious Attachment

This tried and verified trick will download a malicious payload onto the victim’s machine. The URL for that payload is encoded as shown within the image below.

Payload URL obfuscation

After the execution, the QBot Trojan will contact its command and control server and request instructions. Additionally to stealing and exfiltrating data from its victims, QBot also will start grabbing emails which will later be used as a part of subsequent malspam campaigns.

Qbot process flow

Aggressive Malware used in Targeted Campaigns

Besides phishing campaigns, attackers are also often using exploit kits to drop QBot payloads, with the bot subsequently infecting other devices on the victims’ network using network share exploits and highly aggressive brute-force attacks that focus on, Active Directory admin accounts.

QBot banking trojan was mostly utilized in targeted attacks against corporate entities that provide a better return on investment.

World events like the Covid pandemic or the US elections provide perfect material to craft effective schemes leading to high infection ratios.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

JhoneRAT – Hackers Launching New Cloud-based Python RAT to Steal Data From Google Drive, Twitter & Google Forms

Hackers Hosting Malware On Google Sites To Steal Data and Share It to the Remote Server

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles