SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike
Summary: Cisco Talos reported that malspam campaigns beginning in mid-September 2021 delivered malicious Word and Excel documents that installed a new malware loader called SQUIRRELWAFFLE, with the earliest samples submitted to public malware repositories on Sept. 10, 2021. The loader, executed via rundll32.exe or regsvr32.exe, was observed alongside Qakbot and Cobalt Strike infections, and its distribution servers were largely compromised WordPress hosts, most commonly version 5.8.1.
Bottom line: SQUIRRELWAFFLE gives an attacker a foothold that has already been followed by Qakbot and Cobalt Strike on compromised endpoints, and its servers used ANTIBOT and IP blocklists to return 404s to security researchers and automated analysis platforms.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026