Check Point researchers find dangerous new Qbot variant is spreading via malspam campaign to execute credentials theft, ransomware installation and unauthorized banking transactions

Our latest Global Threat Index for August 2020 has revealed that the Qbot trojan, also known as Qakbot and Pinkslipbot, has entered the top ten malware index for the first time, ranking as the 10th most prevalent malware in August, while the Emotet trojan remains in 1st place for a second month, impacting 14% of organizations globally.

First seen in 2008, Qbot has been continually developed and now uses sophisticated credentials theft and ransomware installation techniques, making it the malware equivalent of a Swiss Army knife according to researchers. Qbot now also has a dangerous new feature: a specialized email collector module which extracts email threads from the victim’s Outlook client and uploads them to an external remote server. This enables Qbot to hijack legitimate email conversations from infected users, and then spam itself out using those hijacked emails to increase its chances of tricking other users into getting infected. Qbot can also enable unauthorized banking transactions, by allowing its controller to connect to the victim’s computer.

Check Point’s researchers found several campaigns using Qbot’s new strain between March and August 2020, which included Qbot being distributed by the Emotet trojan.  This campaign impacted 5% of organizations globally in July 2020.

Threat actors are always looking at ways to update existing, proven forms of malware and they have clearly been investing heavily in Qbot’s development to enable data theft on a massive scale from organizations and individuals. Check Point researchers have seen active malspam campaigns distributing Qbot directly, as well as the use of third-party infection infrastructures like Emotet’s to spread the threat even further. The research team advises that businesses should look at deploying anti-malware solutions that can prevent such content reaching end-users and advise employees to be cautious when opening emails, even when they appear to be from a trusted source.

The research team also warns that “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.

Top malware families

*The arrows relate to the change in rank compared to the previous month.

This month Emotet remains the most popular malware with a global impact of 14% of organizations, closely followed by Agent Tesla and Formbook affecting 3% of organizations each.

  1. ↔ Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet was originally a banking Trojan, but recently is used as a distributor of other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
  2. ↑ Agent Tesla – Agent Tesla is an advanced RAT functioning as a keylogger and information stealer , capable of monitoring and collecting the victim’s keyboard input, system clipboard, taking screenshots, and exfiltrating credentials belonging to of a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and Microsoft Outlook email client).
  3. ↑ Formbook – Formbook is an Info Stealer that harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to its C&C orders.
  4. ↔ Trickbot – Trickbot is a dominant banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi purposed campaigns.
  5. ↑ XMRig – XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild in May 2017.
  6. ↑ Ramnit – Ramnit is a banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data.
  7. ↑ Glupteba – Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter.
  8. ↑ RigEK – RigEK delivers exploits for Flash, Java, Silverlight and Internet Explorer. The infection chain starts with a redirection to a landing page that contains JavaScript that checks for vulnerable plug-ins and delivers the exploit.
  9. ↑ Remcos – Remcos is a RAT that first appeared in the wild in 2016. Remcos distributes itself through malicious Microsoft Office documents which are attached to SPAM emails, and is designed to baypass Microsoft Windowss UAC security and execute malware with high-level privileges.
  10. ↑ Qbot – Qbot is a banking Trojan that first appeared in 2008, designed to steal users banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques, to hinder analysis and evade detection.

Top exploited vulnerabilities

This month “Web Server Exposed Git Repository Information Disclosure” is the most common exploited vulnerability, impacting 47% of organizations globally, followed by “MVPower DVR Remote Code Execution” which impacted 43% of organizations worldwide. “Dasan GPON Router Authentication Bypass (CVE-2018-10561)” is in third place, with a global impact of 37%.

  1. ↑ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability that has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information.
  2. ↓MVPower DVR Remote Code Execution – A remote code execution vulnerability that exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
  3. ↑ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass vulnerability that exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system.
  4. ↑ Draytek Vigor Command Injection (CVE-2020-8515) – A command injection vulnerability exists in Draytek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
  5. ↓ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) – An information disclosure vulnerability exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.
  6. ↓ HTTP Headers Remote Code Execution (CVE-2020-13756)- HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
  7. ↑ WordPress xmlrpc Weak Password Access Attempt – Sending a request to xmlrpc.php requires authentication. An attacker may attempt guessing passwords to the system while avoiding the admin login page.
  8. ↔ SQL Injection (several techniques) – Inserting an injection of SQL query in input from client to application, while exploiting a security vulnerability in an application’s software.
  9. ↓Command Injection Over HTTP Payload – A command Injection over HTTP payload vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.
  10. ↑ ZTE F460/F660 Backdoor Unauthorized Access – An Unauthorized Access Vulnerability exists in ZTE F460 and F660 cable modems. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands with administrator level access on the affected device.

Top mobile malware families

This month xHelper is the most popular mobile malware, followed by Necro and Hiddad.

  1. xHelper – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisements. The application can hide itself from the user, and reinstall itself in case it was uninstalled.
  2. Necro – Necro is an Android Trojan Dropper. It can download other malware, showing intrusive ads and stealing money by charging paid subscriptions.
  3. Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

You may also like