Loading malware…
QakBot, also known as QBot, Pinkslipbot, and Quackbot, is a Windows malware family that emerged around 2008 as a banking trojan and evolved into a modular loader and initial-access platform for financially motivated cybercriminals. It enables command execution, credential theft, persistence, network reconnaissance, and delivery of additional payloads. QakBot infections have supported ransomware operations, including attack chains associated with Black Basta and REvil. It is distinct from the unrelated IoT malware sometimes called Qbot or Gafgyt.
Distribution commonly involves phishing and malicious spam containing links or attachments. Observed infection chains have used macro-enabled Office documents, OneNote attachments, password-protected archives, disk images, shortcuts, and obfuscated scripts. Some campaigns use HTML smuggling to assemble malicious archives in the browser. QakBot has also been delivered by Emotet and SmokeLoader. Evasion methods include process injection, payload masquerading, command-line obfuscation, and abuse of valid code-signing certificates.
QakBot performs automated discovery of remote systems, network configuration, shares, accounts, and domain infrastructure using native Windows utilities. It supports worm-like lateral movement through SMB exploitation and can export private keys marked as exportable from the Windows Certificate Store. Its command-and-control communications can use TCP, with infrastructure incorporating compromised hosts on residential broadband networks. Follow-on payloads have included Brute Ratel and Cobalt Strike, enabling further intrusion activity and lateral movement before potential ransomware deployment. Law enforcement disrupted its infrastructure in August 2023.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
16 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Used a tool to exploit CVE-2020-1472 (also known as “ZeroLogon”) to gain Domain Administrative privileges. This tool and its intrusion attempts have been reportedly related to Hancitor and Qbot.
members of the VirusTotal community have linked it to exploitation of CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability also known as Follina. Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT, and Qbot, which has previously delivered ransomware as a later-stage payload. | Threat actors have leveraged Follina to distribute malware, including the Rozena backdoor, AsyncRAT (remote access trojan), and Qbot, which has previously delivered ransomware as a later-stage payload.
First, unpatched Exchange servers are exploited using ProxyShell... We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October. | We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
After approximately 2 minutes, QBot attempted to exploit the PrintNightmare vulnerability by executing the Invoke-Nightmare PowerShell command to create an administrative user with the username admin1 and password Password. | QBot, also known as Qakbot, is a malware that has been present on the threat landscape since 2007. QBot originally featured information stealing and trojan functionalities, however, the malicious actors that develop QBot have extended the malware with malware loading capabilities.
Together they form a re-packaged exploit for Silverlight based on CVE-2016-0034 (MS16-006) – a Silverlight Memory Corruption vulnerability. The exploit has previously been used by several exploit kits including RIG and Angler to deliver multiple crimeware tools. | The DLL (MD5 hash: 7b4a8be258ecb191c4c519d7c486ed8a) is identical to the one reported in a malware traffic analysis blog post from March 2016 where it was used to deliver Qbot.
In early October, the same “TR” distributor was reportedly conducting brute-force attacks on Internet Message Access Protocol (IMAP) services, and there is also speculation from security researchers that “TR” uses ProxyLogon to acquire credentials for the attacks. | QAKBOT is a prevalent information-stealing malware that was first discovered in 2007. In recent years, its detection has become a precursor to many critical and widespread ransomware attacks.
In late October CIRCL got notified about MS Exchange servers vulnerable for the recent critical Exchange RCE vulnerabilities CVE-2021-26427. Microsoft Exchange Server Remote Code Execution Vulnerability
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyLogon – CVE-2021-26855, CVE-2021-27065
The 3rd method - using malformed digital signatures (CVE-2022-44698) - patched on December 13 and is actively exploited in the wild. Because of the malformed digital signature, the loader bypasses the Mark of the Web (MoTW) flag, and the execution proceeds without a Windows warning pop-up message. | At the beginning of November 2022, EclecticIQ analysts examined a recent campaign that delivers QakBot (also called Qbot) to victim devices via phishing emails, executes by abusing multiple Living Off the Land Binaries (LOLBAS) and evades the Mark of the Web (MoTW) flag to increase the infection rate.
CVE-2024-30051 (CVSS skóre 7,8) Zero-day zraniteľnosť v knižnici Windows DWM Core Library by lokálny autentifikovaný útočník s oprávneniami štandardného používateľa mohol prostredníctvom zaslania špeciálne vytvorenej požiadavky zneužiť na eskaláciu privilégií (úroveň SYSTEM) a získať úplnú kontrolu nad systémom. Spoločnosť KASPERSKY informovala o phishingových kampaniach, ktoré túto zraniteľnosť aktívne zneužívajú na šírenie malvéru QAKBOT. | Spoločnosť KASPERSKY informovala o phishingových kampaniach, ktoré túto zraniteľnosť aktívne zneužívajú na šírenie malvéru QAKBOT.
"The threat actor gained initial access to the organization via Qakbot infection..." | The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
Threat Details and IOCs Malware: ... Qbot ...
34 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
QakBot, also called QBot, began as a banking trojan around 2008 and became one of the most widely used initial-access tools for ransomware.
On August 29, 2023, the U.S. Department of Justice announced that a multinational operation successfully disrupted the QakBot botnet, which infected over 700,000 computers worldwide.
On August 29, 2023, the U.S. Department of Justice announced that a multinational operation successfully disrupted the QakBot botnet, which infected over 700,000 computers worldwide.
On August 29, 2023, the U.S. Department of Justice announced that a multinational operation successfully disrupted the QakBot botnet, which infected over 700,000 computers worldwide.
On August 29, 2023, the U.S. Department of Justice announced that a multinational operation successfully disrupted the QakBot botnet, which infected over 700,000 computers worldwide.
On August 29, 2023, the U.S. Department of Justice announced that a multinational operation successfully disrupted the QakBot botnet, which infected over 700,000 computers worldwide.
50 distinct techniques documented for this family, organized by ATT&CK tactic.
3,049 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Provides initial access through phishing and changing delivery formats, including OneNote attachments, HTML smuggling, and ZIP archives. Commonly deploys Cobalt Strike and facilitates ransomware delivery. The article describes disruptions in 2023 and 2025.
Named as a source of capabilities inherited by historical Rebirth/Vulcan malware. The content does not specify those capabilities or establish equivalence with other similarly named malware.
Malware associated here with injecting malicious code into legitimate browser processes via wermgr.exe in order to steal information; the detection notes this could enable arbitrary code execution, privilege escalation, and data exfiltration on the compromised host.
Mentioned only as a comparison point for BumbleBee C2 tracking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.