About cookies on this site Our websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising. For more information, please review your options. By visiting our website, you agree to our processing of information as described in IBM’sprivacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here.
Security researchers spotted a new attack campaign that’s targeting organizations in several countries with a new variant of Qbot banking malware.
In its investigation, Varonis found the campaign consists of phishing emails that come with an attached ZIP file using a .doc.vbs extension. Upon execution, the VBS script extracts information about the target machine’s operating system and attempts to check for strings associated with well-known antivirus software. It then uses the BITSAdmin tool to run a malware loader.
This loader, which has multiple versions signed with different digital certificates, creates a registry value, scheduled task and startup shortcut to establish persistence on the infected machine. It then launches a 32-bit explorer.exe file before injecting the main payload: a new variant of Qbot. This malware is capable of keylogging, stealing credentials/cookies from a web browser and hooking into running processes so it can latch onto users’ banking login information.
Qbot’s Adaptability in Recent Years
Varonis noted that the campaign is mostly targeting corporations located in the U.S., but it also has hit organizations around the world, including companies based in Europe, Asia and South America. Researchers analyzed the threat’s command-and-control (C&C) server and came across evidence suggesting that this Qbot campaign has already claimed thousands of victims.
This isn’t the first time Qbot has gone through some changes. For example, researchers at BAE Systems identified a variant back in April 2016 that incorporated polymorphic code, thereby making itself more difficult to detect. In November 2018, Alibaba Cloud Security uncovered a new version capable of performing brute-force attacks and enlisting infected hosts into a botnet.
How to Defend Against Banking Malware
Security professionals can help defend against banking malware like Qbot by using a unified endpoint management (UEM) platform to set up security policies and compliance rules that automate malware remediation. This step will help streamline the organization’s response capabilities in the event of a malware infection.
Additionally, security professionals should use a sophisticated anti-phishing solution that tracks which brands are under attack and uses machine learning to become proficient in evolving phishing tactics.