Saturday, December 2, 2023

QBot Trojan Attacks Victims with Malicious Election Interference Attachments

QBot malware, also referred to as Qakbot and Pinkslipbot, is a banking Trojan active since 2008. Attackers are using the QBot malware with updated worm features to steal users’ keystrokes, deploy backdoors, and spread malware payloads on compromised devices.

Researchers stated that the newest version of QBot has detection and research-evasion techniques that hide the malware codes and shake scanners and anti-software tools.

As U.S. election night ended, uncertainty regarding the results began to sneak in, threat actors decided to leap in thereon too. In observation, a new spam campaign delivering malicious attachments that exploit doubts about the election process.

The QBot banking Trojan operators return also with the U.S. election-themed phishing emails enticing victims with malicious election interference attachments.

Hijacked Email Threads Pushing False DocuSign Documents

The malicious emails come as thread replies, almost like what Emotet (Trojan that is primarily spread through spam emails) does to add legitimacy and make detection harder.

They contain zip attachments suitably named ElectionInterference_[8 to 9 digits](.)zip(as shown within the image below).

Phishing Email

While the election results are still being assessed and debated, victims are tempted to open up the document to examine alleged election interference.

The extracted file is an Excel spreadsheet (as shown below) disguised as a secure DocuSign file allegedly containing information associated with election interference. When the potential victims open bait documents, they are tricked to permit macros to ‘decrypt’ the document.

Malicious Attachment

This tried and verified trick will download a malicious payload onto the victim’s machine. The URL for that payload is encoded as shown within the image below.

Payload URL obfuscation

After the execution, the QBot Trojan will contact its command and control server and request instructions. Additionally to stealing and exfiltrating data from its victims, QBot also will start grabbing emails which will later be used as a part of subsequent malspam campaigns.

Qbot process flow

Aggressive Malware used in Targeted Campaigns

Besides phishing campaigns, attackers are also often using exploit kits to drop QBot payloads, with the bot subsequently infecting other devices on the victims’ network using network share exploits and highly aggressive brute-force attacks that focus on, Active Directory admin accounts.

QBot banking trojan was mostly utilized in targeted attacks against corporate entities that provide a better return on investment.

World events like the Covid pandemic or the US elections provide perfect material to craft effective schemes leading to high infection ratios.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

JhoneRAT – Hackers Launching New Cloud-based Python RAT to Steal Data From Google Drive, Twitter & Google Forms

Hackers Hosting Malware On Google Sites To Steal Data and Share It to the Remote Server


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles