Loading story…
Researchers reported that KBOT is an active Windows file-infector that spreads by injecting polymorphic malicious code into EXE and DLL files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels.
The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining file infection, financial theft, stealthy persistence, and attacker-controlled administration in a single threat.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky published a technical analysis of the KBOT Windows malware family, describing its file-infecting behavior, propagation methods, persistence, credential theft, web injects, remote access features, and command-and-control mechanisms.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new **Betabot** (also known as **Neurevt**) campaign hitting customer environments through phishing emails carrying weaponized Microsoft Word documents disguised as RTF files that exploit **`CVE-2017-11882`** in the Microsoft Office Equation Editor. The infection chain used embedded scripts and an **NSIS-based dropper** to unpack the payload, inject it into processes such as **`Explorer.exe`**, and establish persistence through registry autoruns and, in some cases, scheduled tasks before reaching command-and-control infrastructure. Betabot has re-emerged as a mature infostealer descended from a banking Trojan, with capabilities that include credential theft, form grabbing, arbitrary command execution, malware downloads, **DDoS**, USB propagation, and even a cryptocurrency miner module. Earlier analysis of the malware family documented administration-panel features for bot management, SOCKS4 proxying, browser homepage changes, forced URL visits, updates, file downloads, and form-grabber logs, while the latest campaign also showed extensive self-protection through anti-debugging, anti-VM and anti-sandbox checks, antivirus interference, API hooking to conceal persistence, and a **BotKiller** function to remove competing malware.
Aug 15, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
Elastic Security Labs documented **Qbot/QakBot** (also known as QBOT), a long-running modular Windows banking trojan used by multiple threat actors and ransomware affiliates. In the analyzed activity, the malware executed as a DLL through the legitimate Windows `regsvr32.exe` utility, used `cmd.exe` and `curl.exe`, injected into `explorer.exe`, copied itself into a randomly named directory beneath the user AppData path, and established persistence through Registry Run keys and scheduled tasks intended to run with **SYSTEM** privileges. Qbot used anti-analysis and defense-evasion checks to identify sandbox, monitoring, and security products, and could add its persistence location to Microsoft Defender exclusions when Defender was present. It avoided execution on systems configured for Russian and several Eastern European, Central Asian, and Caucasus-region languages. The malware communicated with a distributed C2 network over HTTP or TLS using encrypted, Base64-encoded JSON, enabling operators to deliver updates, execute shell or PowerShell commands, and inject or launch additional binaries; Elastic identified 138 associated IP addresses and linked the infrastructure to hundreds of malicious files.
Sep 9, 2026