The New Version of Qbot Trojan Steals Damn Near Everything, Hijacks Email Threads to Spread Infection

trojan attackOriginally seen all the way back in 2008, this banking trojan is continuously being developed. Its latest iteration is downright nasty and has already infected 5% of all organizations worldwide.

Bad guys today generally have two goals with every infection. First, infect the targeted endpoint to begin the work of whatever malicious threat action (e.g. ransomware, remote access, etc.) needs to come next. Second, they want to use that compromised making as the launchpad for an attack on other organizations.

The latest version of Qbot does both is such a sinister way, it’s a bit scary.

According to new research from Checkpoint, Qbot contains a number of collector modules. One is used to harvest browsing data, email records, and banking credentials. Another uses mimikatz to scrape RAM for credentials. And still another new module seen by Checkpoint, extracts specific email threads related to tax payments, job recruitment, and COVID-19 from the endpoint’s Outlook client, uploading them to the attacker's command-and-control (C2) server.

The email threads are used to hijack the conversation where the cybercriminals send emails impersonating the compromised email account’s owner, providing malicious attachments and links in an effort to increase their reach into other organizations.

Qbot is no joke; it’s a very powerful tool that’s definitely in the wrong hands.

Organizations need to protect themselves with a layered security strategy that includes Security Awareness Training to empower users with knowledge of phishing attack methods, social engineering tactics, and how to keep from falling for these very prevalent attacks.

Find out which of your users' emails are exposed before bad actors do.

Many of the email addresses and identities of your organization are exposed on the internet and easy to find for cybercriminals. With that email attack surface, they can launch social engineering, spear phishing and ransomware attacks on your organization. KnowBe4's Email Exposure Check Pro (EEC) identifies the at-risk users in your organization by crawling business social media information and now thousands of breach databases.

EECPro-1Here's how it works:

  • The first stage does deep web searches to find any publicly available organizational data
  • The second stage finds any users that have had their account information exposed in any of several thousand breaches
  • You will get a summary report PDF as well as a link to the full detailed report
  • Results in minutes!

Get Your Free Report

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Anti-Phishing Guide ebook

Get the latest about social engineering

Subscribe to CyberheistNews