A new email phishing campaign has been spotted looking to compromise additional endpoints for the Qakbot botnet.
Qakbot has been around for almost 15 years, haivng reinvented itself on multiple occasions throughout its life, and is now hijacking people’s email threads to distribute the payload to more devices.
Cybersecurity researchers from Sophos discovered once Qakbot infects a device, it delivers a payload that scans it for email accounts and its login credentials. If it is successful, it will go through the inbox and send out replies to every available email threat (as opposed to just sending out a new email to all contacts). The reply will carry a quote of the original message, as well as a malicious payload in the attachment.
Multi-stage attacks
By replying to an ongoing thread, instead of sending out a new email, the threat actor hopes to lower the guard of the victim. People may be vigilant when receiving shady emails out of the blue, but when they get a reply, from a known contact, in an ongoing thread, they might be more inclined to examine the contents of the attachment.
Besides English, the lure can be sent out in multiple other languages, Sophos warns, depending on the language of the original email thread.
Quakbot’s real danger, however, lies in the fact that it can serve as the stage-one malware in a multi-stage attack. It can deliver other, more sinister payloads, such as ransomware.
"Qakbot is a full-service botnet that performs data theft and malware delivery services on behalf of either themselves or third parties. They clearly take advantage of credential theft to access the websites belonging to innocent third parties to use for hosting payloads," Andrew Brandt, principal researcher at Sophos Labs told ZDNet.
As usual, users are advised to be extra cautious when receiving emails with attachments, regardless of who the sender is.
- Check out our rundown of the best identity theft protection services right now
Via: ZDNet
