The Qakbot malware family is covered through reported incidents, technical analysis, infrastructure findings, disruption efforts, and defensive guidance.
Search across headline titles and summaries.
Background for this topic.
Qakbot (Qbot) is a Windows malware family first identified around 2009. It evolved from a banking-information stealer into a modular backdoor that can log keystrokes, steal credentials, exfiltrate data, and download additional payloads. Reported compromises have also used it as a delivery layer for other malware, including ransomware. Its botnet functionality enables infected hosts to communicate with attacker-controlled infrastructure.
Qakbot matters because a successful phishing infection can expose credentials and create a path for follow-on malware. Defenses include filtering suspicious attachments and links, applying security updates, using multifactor authentication where possible, and monitoring unusual process, network, and authentication activity. When detected, isolate the host, preserve email and endpoint telemetry, reset potentially exposed credentials, and check other systems for related indicators or payloads. Threat intelligence on Qakbot infrastructure can help block activity and scope an incident, but indicators should be validated because infrastructure and artifacts change.
Weekly headline count for the current query.
The U.S. government has indicted Russian national Rustam Rafailevich Gallyamov, the leader of the Qakbot botnet malware operation that compromised over 700,000 computers and enabled ransomware attacks. [...]
Microsoft has fixed a zero-day vulnerability exploited in attacks to deliver QakBot and other malware payloads on vulnerable Windows systems. [...]
The developer of Qakbot malware, or someone with access to the source code, seems to be experimenting with new builds as fresh samples have been observed in email campaigns since mid-December. [...]
The QakBot malware is once again being distributed in phishing campaigns after the botnet was disrupted by law enforcement over the summer. [...]
A sophisticated phishing campaign pushing the DarkGate malware infections has recently added the PikaBot malware into the mix, making it the most advanced phishing campaign since the Qakbot operation was dismantled. [...]
The FBI announced today the disruption of the Qakbot botnet in an international law enforcement operation that not only seized infrastructure but also uninstalled the malware from infected devices. [...]
Qakbot, one of the largest and longest-running botnets to date, was taken down following a multinational law enforcement operation spearheaded by the FBI and known as Operation DuckHunt. [...]
The widespread malware known as Qbot (aka Qakbot or QuakBot) has recently returned to light-speed attacks, and according to analysts, it only takes around 30 minutes to steal sensitive data after the initial infection. [...]