The Check Point Research report, Global Threat Index for August 2020, noted that the Qbot trojan, also known as Qakbot and Pinkslipbot, has entered the top ten malware index for the first time, ranking as the 10th most prevalent malware in August, while the Emotet trojan remains in 1st place for a second month, impacting 14% of organisations globally.
First seen in 2008, Qbot has been continually developed and now uses sophisticated credentials theft and ransomware installation techniques, making it the malware equivalent of a Swiss Army knife according to researchers.
Qbot now also has a dangerous new feature: a specialised email collector module which extracts email threads from the victim’s Outlook client and uploads them to an external remote server.
This enables Qbot to hijack legitimate email conversations from infected users, and then spam itself out using those hijacked emails to increase its chances of tricking other users into getting infected.
Qbot can also enable unauthorised banking transactions, by allowing its controller to connect to the victim's computer.
Check Point’s researchers found several campaigns using Qbot’s new strain between March and August 2020, which included Qbot being distributed by the Emotet trojan. This campaign impacted 5% of organisations globally in July 2020.
Maya Horowitz, director, Threat Intelligence & Research, Products at Check Point, said threat actors are always looking at ways to update existing, proven forms of malware. The heavy investment in Qbot’s development has enabled data theft on a massive scale from organisations and individuals.
Check Point has seen active malspam campaigns distributing Qbot directly, as well as the use of third-party infection infrastructures like Emotet's to spread the threat even further.
“Businesses should look at deploying anti-malware solutions that can prevent such content reaching end-users and advise employees to be cautious when opening emails, even when they appear to be from a trusted source,” suggested Horowitz.
