securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MUST READ

Headlines
 * New QBot campaign delivered hijacking business correspondence
 * China-linked APT41 group spotted using open-source red teaming tool GC2
 * Vice Society gang is using a custom PowerShell tool for data exfiltration
 * Experts warn of an emerging Python-based credential harvester named Legion
 * Experts found the first LockBit encryptor that targets macOS systems
 * NCR was the victim of BlackCat/ALPHV ransomware gang



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


NEW QBOT CAMPAIGN DELIVERED HIJACKING BUSINESS CORRESPONDENCE

April 17, 2023  By Pierluigi Paganini




KASPERSKY RESEARCHERS WARN OF A NEW QBOT CAMPAIGN LEVERAGING HIJACKED BUSINESS
EMAILS TO DELIVER MALWARE.

In early April, Kaspersky experts observed a surge in attacks that QBot malware
attacks (aka Qakbot, QuackBot, and Pinkslipbot). QBot has been active since
2008, it is used by threat actors for collecting browsing data and banking
credentials, and other financial information from the victims.

Its modular structure allows operators to implement new features to extend their
capabilities.

The Qbot malware operation had numerous collaborations in the past with other
ransomware gangs, including ProLock, Egregor, DoppelPaymer, and MegaCortex.

The threat actors behind the campaign observed by Kaspersky used e-mail written
in different languages, including English, German, Italian, and French.

The malicious code hijacks a victim’s email and sends itself out as a reply to
an existing email thread.

The messages would be urging the recipients to open an enclosed PDF file. As an
example, the attackers can attempt to trick the recipient into opening the file
by asking them to provide the documentation pertaining to the attached
application or to calculate the contract value based on the attached cost
estimate. During the recent campaign, the enclosed PDF file masquerades as a
Microsoft Office 365 or Microsoft Azure alert.

New QBot infection chain

“The QBot malware delivery scheme begins with an e-mail letter with a PDF file
in the attachment being sent. The document’s content imitates a Microsoft Office
365 or Microsoft Azure alert advising the user to click Open to view the
attached files.” reads the report published by Kaspersky. “If the user complies,
an archive will be downloaded from a remote server (compromised site), protected
with a password given in the original PDF file.”

Upon opening the attachment, it will retrieve an archive from a compromised
website. The archive contains an obfuscated Windows Script File (.WSF) that
includes an obfuscated JScript.



Once the WSF file is deobfuscated, it contains a PowerShell script encoded into
a Base64 line that downloads a malicious DLL, the QBot malware, from a remote
server.

“According to our data, the first letters with malicious PDF attachments began
to arrive in the evening of April 4. The mass e-mail campaign began at 12:00
p.m. on the following day and continued until 9:00 p.m. During that time we
detected an approximate total of 1,000 letters. The second upsurge began on
April 6, again at noon, with over 1,500 letters dispatched to our customers this
time. For the next few days new messages kept coming, and soon, on the evening
of April 12 we discovered another upsurge with 2,000 more letters sent to our
customers.” continues the report. “After that cybercriminal activity went down,
but users still receive fraudulent messages.”

Most of the infections related to this campaign were observed in Germany
(28.01%), Argentina (9.78%), and Italy (9.58%).



Please vote for Security Affairs (https://securityaffairs.com/) as the best
European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:

 * The Teacher – Most Educational Blog
 * The Entertainer – Most Entertaining Blog
 * The Tech Whizz – Best Technical Blog
 * Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

> > Nominate
> > here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, QBot)




SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


CybercrimeHackinghacking newsinformation security newsIT Information
SecuritymalwarePierluigi PaganiniQbotSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

China-linked APT41 group spotted using open-source red teaming tool GC2


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


CHINA-LINKED APT41 GROUP SPOTTED USING OPEN-SOURCE RED TEAMING TOOL GC2

April 17, 2023  By Pierluigi Paganini

VICE SOCIETY GANG IS USING A CUSTOM POWERSHELL TOOL FOR DATA EXFILTRATION

April 17, 2023  By Pierluigi Paganini






 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER
   
   


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

CHINA-LINKED APT41 GROUP SPOTTED USING OPEN-SOURCE RED TEAMING TOOL GC2

China-linked APT41 group used the open-source red teaming tool GC2 in an attack
against a Taiwanese media organization. Google...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version