Loading story…
QAKBOT resumed large-scale email spam activity after a roughly three-month pause, using hijacked email threads and malicious attachments to reestablish itself as an initial-access malware operation often seen before ransomware deployment. Researchers linked the activity to the distributor TR, which has also been associated with SquirrelWaffle delivery and reported IMAP brute-force operations, underscoring the role of spam-driven access brokers in broader intrusion chains.
The renewed campaign introduced changes from earlier QAKBOT waves by combining VBA macros with Excel 4.0 macros in weaponized documents. The infection chain extracted embedded data, built a command to download a QAKBOT DLL from remote hosts, executed it through regsvr32.exe using the -silent parameter, and established persistence with a scheduled task. The malware has historically served as a precursor to ransomware incidents involving MegaCortex, PwndLocker, Egregor, ProLock, and Sodinokibi/REvil.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
In early October 2021, the malware distributor known as TR was reportedly conducting brute-force attacks against IMAP services. Researchers speculated that TR may have used ProxyLogon to obtain credentials for those attacks.
Toward the end of September 2021, QAKBOT operators resumed email spam operations after an almost three-month hiatus. The renewed campaign used hijacked email threads to improve infection success and impersonate trusted correspondents.
The article notes that earlier QAKBOT waves observed before the June 2021 break used different macro techniques than the later campaign. This marks the end of activity before an almost three-month hiatus.
The report states that QAKBOT infections were linked to Sodinokibi/REvil ransomware deployments in 2021. This further underscored QAKBOT's role in enabling ransomware operations.
The report says QAKBOT infections were linked to subsequent Egregor and ProLock ransomware deployments in 2020. This continued the pattern of QAKBOT serving as a precursor to ransomware intrusions.
The report states that QAKBOT infections were linked to later deployments of the MegaCortex and PwndLocker ransomware families in 2019. This reflects QAKBOT's role as an initial-access malware preceding human-operated ransomware.
The QAKBOT information-stealing malware family was first discovered in 2007. It later evolved into a malware-installation-as-a-service botnet used in broader attack campaigns.
The latest QAKBOT campaign used VBA macros alongside Excel 4.0 macros, extracted embedded data to build a DLL download command, and executed the payload via regsvr32.exe with the -silent parameter. The malware also maintained persistence through a scheduled task.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Qakbot** has reappeared months after the law-enforcement-led Duck Hunt disruption, with researchers observing a new phishing campaign that targeted organizations in the hospitality sector. The activity used malicious PDF lures to deliver MSI installers containing a patched Internet Download Manager DLL and embedded Qakbot components, reviving a malware family long associated with credential theft, lateral movement, and follow-on ransomware operations. Analysis of the new samples showed Qakbot relying on `rundll32.exe`, Acrobat-themed decoy behavior, and process hollowing into `wermgr.exe` to run its final payload from memory while attempting to evade detection. Researchers also highlighted Qakbot's continued use of RC4-encrypted Windows Registry entries to store victim identifiers and command-and-control data, a technique documented in separate analysis focused on decrypting the malware's encrypted registry keys and tracking its persistent tradecraft.
Aug 15, 2026
Multiple incident reports describe **Qakbot** infections delivered through phishing emails that linked to ZIP archives containing malicious Excel files, often using Excel 4.0 macros to fetch DLL payloads. On compromised Windows systems, the malware executed downloaded DLLs with `regsvr32.exe`, contacted multiple command-and-control servers, and in some cases used distribution tags such as **`obama166`** and **`aa`**. Researchers observed Qakbot storing artifacts on disk, changing persistence behavior compared with earlier variants, and in broader campaigns stealing Outlook credentials, adding Windows Defender exclusions, and using internal email threads to spread further inside organizations. Follow-on activity showed operators deploying **Cobalt Strike** and VNC-based remote access, including **DarkVNC** traffic over TCP 443 and VNC beaconing detected after the initial compromise. In one analyzed case, Cobalt Strike and VNC activity appeared about 17 hours after infection, indicating a second-stage intrusion after Qakbot established foothold. Additional reporting ties these intrusions to hands-on-keyboard actions such as reconnaissance, lateral movement over SMB admin shares, service-based persistence, and preparation for ransomware deployment, while one campaign also reportedly abused **PrintNightmare** (`CVE-2021-34527`) for SYSTEM-level execution and may have leveraged **ProxyLogon** and **ProxyShell** to help distribute malicious emails in enterprise environments.
Aug 15, 2026
Threat actors used **QakBot** (also tracked as **QBot/QuackBot**) as an initial access and post-compromise platform in corporate intrusions, delivering the malware through phishing campaigns that evolved from malicious Office documents to password-protected ZIP archives, **MSI** installers, **OneNote** files, **LNK/XLL** payloads, and script-based chains. Across these campaigns, QakBot established persistence, injected into legitimate processes, conducted host and domain reconnaissance, stole credentials and other data, and communicated with command-and-control servers over encrypted HTTP/HTTPS channels before staging additional payloads.
Aug 15, 2026