QBot Trojan Attacks Victims with Malicious Election Interference Attachments

QBot malware, also referred to as Qakbot and Pinkslipbot, is a banking Trojan active since 2008. Attackers are using the QBot malware with updated worm features to steal users’ keystrokes, deploy backdoors, and spread malware payloads on compromised devices.

Researchers stated that the newest version of QBot has detection and research-evasion techniques that hide the malware codes and shake scanners and anti-software tools.

As U.S. election night ended, uncertainty regarding the results began to sneak in, threat actors decided to leap in thereon too. In observation, a new spam campaign delivering malicious attachments that exploit doubts about the election process.

The QBot banking Trojan operators return also with the U.S. election-themed phishing emails enticing victims with malicious election interference attachments.

Hijacked Email Threads Pushing False DocuSign Documents

The malicious emails come as thread replies, almost like what Emotet (Trojan that is primarily spread through spam emails) does to add legitimacy and make detection harder.

They contain zip attachments suitably named ElectionInterference_[8 to 9 digits](.)zip(as shown within the image below).

While the election results are still being assessed and debated, victims are tempted to open up the document to examine alleged election interference.

The extracted file is an Excel spreadsheet (as shown below) disguised as a secure DocuSign file allegedly containing information associated with election interference. When the potential victims open bait documents, they are tricked to permit macros to ‘decrypt’ the document.

This tried and verified trick will download a malicious payload onto the victim’s machine. The URL for that payload is encoded as shown within the image below.

After the execution, the QBot Trojan will contact its command and control server and request instructions. Additionally to stealing and exfiltrating data from its victims, QBot also will start grabbing emails which will later be used as a part of subsequent malspam campaigns.

Aggressive Malware used in Targeted Campaigns

Besides phishing campaigns, attackers are also often using exploit kits to drop QBot payloads, with the bot subsequently infecting other devices on the victims’ network using network share exploits and highly aggressive brute-force attacks that focus on, Active Directory admin accounts.

QBot banking trojan was mostly utilized in targeted attacks against corporate entities that provide a better return on investment.

World events like the Covid pandemic or the US elections provide perfect material to craft effective schemes leading to high infection ratios.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

JhoneRAT – Hackers Launching New Cloud-based Python RAT to Steal Data From Google Drive, Twitter & Google Forms

Hackers Hosting Malware On Google Sites To Steal Data and Share It to the Remote Server