Wednesday , February 19 2025

New QBot email attacks use PDF and WSF combo to install malware

QBot malware is now distributed in phishing campaigns utilizing PDFs and Windows Script Files (WSF) to infect Windows devices.

Qbot (aka QakBot) is a former banking trojan that evolved into malware that provides initial access to corporate networks for other threat actors. This initial access is done by dropping additional payloads, such as Cobalt StrikeBrute Ratel, and other malware that allows other threat actors to access the compromised device.

150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
150 Gov.t Portal affected  Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru

Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
Builder claims Rs 150 cr for data loss;  AWS faces FIR In Bengaluru

CISA Warns Active Exploitation of Apple iOS Security Flaw

CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
CISA Warns Active Exploitation of Apple iOS Security Flaw

Massive IoT Data Breach Exposes 2.7 Billion Records

A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
Massive IoT Data Breach Exposes 2.7 Billion Records

SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

Lazarus Group Unleashes New Malware Against Developers Worldwide

Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
Lazarus Group Unleashes New Malware Against Developers Worldwide

Daily Security Update Dated : 15.02.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated : 15.02.2025

Salt Typhoon to target Bangladeshi Universities, One identified

RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
Salt Typhoon to target Bangladeshi Universities, One identified
Using this access, the threat actors spread laterally through a network, stealing data and eventually deploying ransomware in extortion attacks.

Starting this month, security researcher ProxyLife and the Cryptolaemus group have been chronicling Qbot’s use of a new email distribution method — PDF attachments that download Windows Script Files to install Qbot on victim’s devices.

It starts with an email

QBot is currently being distributed through reply-chain phishing emails, when threat actors use stolen email exchanges and then reply to them with links to malware or malicious attachments.

The use of reply-chain emails is an attempt to make a phishing email less suspicious as its a reply to an ongoing conversation.

The phishing emails use a variety of languages, marking this as a worldwide malware distribution campaign.

QBot phishing email
QBot phishing email
Source: BleepingComputer

Attached to these emails is a PDF file named ‘CancelationLetter-[number].pdf ,’ that, when opened, displays a message stating, “This document contains protected files, to display them, click on the “open” button.”

However, when the button is clicked, a ZIP file that contains a Windows Script (wsf) file will be downloaded instead.

PDF document used to distribute malicious WSF files
PDF document used to distribute malicious WSF files
Source: BleepingComputer

A Windows Script File ends with a .wsf extension and can contain a mixture of JScript and VBScript code that is executed when the file is double-clicked.

The WSF file used in the QBot malware distribution campaign is heavily obfuscated, with the ultimate goal of executing a PowerShell script on the computer.

Malicious WSF file distributed by QBot PDF files
Malicious WSF file distributed by QBot PDF files
Source: BleepingComputer

The PowerShell script that is executed by the WSF file attempts to download a DLL from a list of URLs. Each URL is tried until the file is successfully downloaded to the %TEMP% folder and executed.

PowerShell script executed by the WSF file
PowerShell script executed by the WSF file
Source: BleepingComputer

When the QBot DLL is executed, it will run the PING command to determine if there is an internet connection. The malware will then inject itself into the legitimate Windows wermgr.exe (Windows Error Manager) program, where it will quietly run in the background.

QBot malware injected into the memory of the Wermgr.exe process
QBot malware injected into the memory of the Wermgr.exe process
Source: BleepingComputer

QBot malware infections can lead to devastating attacks on corporate networks, making it vital to understand how the malware is being distributed.

Ransomware affiliates linked to multiple Ransomware-as-a-Service (RaaS) operations, including BlackBasta, REvil, PwndLocker, EgregorProLock, and MegaCortex, have used Qbot for initial access into corporate networks.

Researchers at The DFIR Report have shown that it only takes around 30 minutes for QBot to steal sensitive data after the initial infection. Even worse, malicious activity only takes an hour to spread to adjacent workstations.

Therefore, if a device becomes infected with QBot, it is critical to take the system offline as soon as possible and perform a complete evaluation of the network for unusual behavior.

Check Also

January 2025

TRACKING RANSOMWARE
Akira Topped January 2025 as the Most Active Ransomware Threat

In January 2025, there were 510 global ransomware incidents, with Akira as the leading group …

Leave a Reply

Your email address will not be published. Required fields are marked *