Cybersecurity researchers have found that attackers are exploiting the recently discovered Windows zero-day flaw dubbed “Follina” to infect victims’ computers with Qbot malware. Qbot operators have also teamed up with the Black Basta group to spread ransomware.
Qbot, also known as QuakBot QakBot, and Pinkslipbot, was first identified in 2008 as a trojan capable of stealing credentials, bank details, and other sensitive data from Windows machines. The trojan has now evolved into sophisticated malware with phishing capabilities such as email hijacking.
Researchers from cybersecurity firm Proofpoint claim that a hacker group (TA570) abuses the CVE-2022-30190 flaw by hijacking an email thread and tracking victims to open HTML attachments that download .zip files. These archives contain a disk image (IMG) file with a shortcut file, DLL, and Word document.
“The LNK will execute the DLL to start Qbot. The doc will load and execute an HTML file containing PowerShell abusing CVE-2022-30190 used to download and execute Qbot,” the researchers wrote on Twitter.
According to the malware analyst ExecuteMalware, Qbot operators also use ISO files instead of IMG in phishing campaigns to infect PCs. Moreover, the analyst has also published a list of indicators of compromise to help IT teams mitigate the threats.
It is important to note that Qbot operators are collaborating with a ransomware group called “Black Basta” to compromise enterprise networks. Security researchers have found that Black Basta uses double-extortion methods to demand ransomware. This involves stealing sensitive information, encrypting it, and then threatening the victim to upload the data on the Black Basta Blog.
Microsoft acknowledged the remote code vulnerability (CVE-2022-30190) last week, but the company has yet to release a fix to address it. The security flaw is currently being used in phishing campaigns to target EU and US government agencies. Meanwhile, Microsoft has provided a couple of temporary workarounds, and you can find more details in our previous post.