Block title

-

Evolved Qbot trojan equivalent to a Swiss army knife

- Advertisment -

Check Point researchers find dangerous new Qbot variant is spreading via malspam campaigns to execute credentials theft, ransomware installation and unauthorised banking transactions 

Check Point Research has published its latest Global Threat Index for August 2020.  Researchers found that the Qbot trojan, also known as Qakbot and Pinkslipbot, has entered the top ten malware index for the first time, ranking as the tenth most prevalent malware in August, while the Emotet trojan remains in first place for a second month, impacting 14% of organisations globally.

First seen in 2008, Qbot has been continually developed and now uses sophisticated credentials theft and ransomware installation techniques, making it the malware equivalent of a Swiss army knife, according to researchers. Qbot now also has a dangerous new feature: a specialised email collector module which extracts email threads from the victim’s Outlook client and uploads them to an external remote server. This enables Qbot to hijack legitimate email conversations from infected users, and then spam itself out using those hijacked emails to increase its chances of tricking other users into getting infected. Qbot can also enable unauthorised banking transactions by allowing its controller to connect to the victim’s computer.

Check Point’s researchers found several campaigns using Qbot’s new strain between March and August 2020, which included Qbot being distributed by the Emotet trojan.  This campaign impacted 5% of organisations globally in July 2020.

“Threat actors are always looking at ways to update existing, proven forms of malware and they have clearly been investing heavily in Qbot’s development to enable data theft on a massive scale from organisations and individuals. We have seen active malspam campaigns distributing Qbot directly, as well as the use of third party infection infrastructures like Emotet’s, to spread the threat even further. Businesses should look at deploying anti-malware solutions that can prevent such content reaching end users and advise employees to be cautious when opening emails, even when they appear to be from a trusted source,” said Maya Horowitz, Director, Threat Intelligence & Research, Products, at Check Point.

The research team also warns that “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organisations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organisations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.

The complete list of the top 10 malware families in August can be found on the Check Point Blog.

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest articles

September EngineerIT now online

Full speed into the future with AI To streamline processes, maximise resources and optimise data usage in the business, backup and disaster recovery (DR) processes...

Energy Loggers to identify critical energy savings

Energy is a significant cost at any industrial facility, and while managers view energy as an unavoidable expense, it’s really a variable cost that...

Panel discussion: AI for good – for good business

Artificial intelligence and machine learning are fast moving out of the hype status and into the reality status. South African industry recently launched the...

GEOMAGNETIC STORM WARNING

A solar wind stream is heading for Earth and it could spark the strongest geomagnetic storm in more than a year. NOAA forecasters say...

RF Electromechanical Relay Switch Applications

RF electromechanical switches are a key active device in many signal chains, including time-domain duplex communications and pulsed radar applications. Such switches can be...

Understand compliance obligations to local regulations

Businesses operating in South Africa can now map and understand their obligations, roles and responsibilities to comply with local regulations and legislation – most...
- Advertisement -

Global tech brand OPPO invests in South Africa

Soon, South African consumers stand to benefit from the innovations such as SuperVOOC rapid charging and bespoke audio tuning that OPPO has spread around...

SiC MOSFETs with high switching speeds

New N-channel devices offer compelling array of characteristics  RS Components (RS) now stocks ON Semiconductor’s latest 1200V-rated MOSFETs. Based on silicon-carbide (SiC) technology, these power...

Qorvo CMD328K3 low cost alternative to hybrid amplifiers

Qorvo’s CMD328K3 is ideally suited for EW and communications systems where small size and low power consumption are needed. The broadband device delivers greater...

Adapting the supply chain to the ‘new normal’

“It is prudent for the supply chain, particularly in the Fast-Moving Consumer Goods (FMCG) industry, to embrace the ‘new normal”, says Andrew Dawson, MD...

Why is local no longer lekker?

At the end of every year, analysts make predictions about the state of the industry the following year. While 2020 has brought many unexpected...