Qbot Malware Operators Exploit Windows MSDT Zero-Day Flaw to Infect PCs
Cybersecurity researchers have found that attackers are exploiting the recently discovered Windows zero-day flaw dubbed “Follina” to infect victims’ computers with Qbot malware. Qbot operators have also teamed up with the Black Basta group to spread ransomware.
Qbot, also known as QuakBot QakBot, and Pinkslipbot, was first identified in 2008 as a trojan capable of stealing credentials, bank details, and other sensitive data from Windows machines. The trojan has now evolved into sophisticated malware with phishing capabilities such as email hijacking.
Researchers from cybersecurity firm Proofpoint claim that a hacker group (TA570) abuses the CVE-2022-30190 flaw by hijacking an email thread and tracking victims to open HTML attachments that download .zip files. These archives contain a disk image (IMG) file with a shortcut file, DLL, and Word document.
“The LNK will execute the DLL to start Qbot. The doc will load and execute an HTML file containing PowerShell abusing CVE-2022-30190 used to download and execute Qbot,” the researchers wrote on Twitter.
According to the malware analyst ExecuteMalware, Qbot operators also use ISO files instead of IMG in phishing campaigns to infect PCs. Moreover, the analyst has also published a list of indicators of compromise to help IT teams mitigate the threats.
Black Basta ransomware group teams up with Qbot malware operators
It is important to note that Qbot operators are collaborating with a ransomware group called “Black Basta” to compromise enterprise networks. Security researchers have found that Black Basta uses double-extortion methods to demand ransomware. This involves stealing sensitive information, encrypting it, and then threatening the victim to upload the data on the Black Basta Blog.
Microsoft acknowledged the remote code vulnerability (CVE-2022-30190) last week, but the company has yet to release a fix to address it. The security flaw is currently being used in phishing campaigns to target EU and US government agencies. Meanwhile, Microsoft has provided a couple of temporary workarounds, and you can find more details in our previous post.
More in Security
Microsoft Defender Vulnerability Management Adds New CVE Reporting Feature
Jun 30, 2022 | Rabia Noureen
Microsoft Releases Patches to Address Azure FabricScape Flaw Affecting Linux Workloads
Jun 29, 2022 | Rabia Noureen
Microsoft Defender for Identity Can Now Detect Insecure Domain Configurations
Jun 27, 2022 | Rabia Noureen
CISA Warns Unpatched VMware Servers Remain Vulnerable to Log4Shell
Jun 24, 2022 | Rabia Noureen
QNAP Releases Patch to Fix PHP Security Flaw Affecting Select NAS Devices
Jun 23, 2022 | Rabia Noureen
Microsoft Unveils New Edge Secured-Core IoT Devices to Block Firmware Attacks
Jun 22, 2022 | Rabia Noureen
Most popular on petri