Research Spotlight: The Resurgence of Qbot
Summary: Cisco Talos analyzed 618 packed Qbot samples that unpacked to 73 unique samples, with the malware's packer randomizing strings and code blocks between samples to defeat detection signatures. Qbot's authors appear to have stopped development on 3/08/2016, though their servers continued hosting packed executables as late as 3/25/2016, and unpacked binaries carried compile times between 6am and 8pm GMT on a Monday-Friday schedule.
What you should know: Qbot steals banking credentials and FTP credentials, then injects code into live browser sessions to bypass simple two-factor authentication, and its Webinjects in all 618 samples redirected browsers on logout to keep stolen cookies and session tokens alive. The compile-time pattern - one weekend of work in 17 weeks, with packing shifted about two hours later - suggests a full-time operation rather than a side project, so the lull in development is not evidence the threat retired.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026