Everybody Gets One: QtBot Used to Distribute Trickbot and Locky
Summary: Unit 42 researchers observed Necurs malspam campaigns distributing Microsoft Office documents that abuse DDE to load an intermediate downloader tagged QtBot, which replaces the earlier VBA script and uses GeoIP checks to serve Trickbot to hosts in the UK, IE, AU, GB, LU, or BE and Locky elsewhere. Palo Alto Networks has observed more than 4 million unique sessions with QtBot activity since October 19, 2017, and the downloader carries an anti-analysis suite that scans for analysis tools and terminates if any are found.
Why it matters: Two previously separate malware affiliates are now sharing unified malspam campaigns and a single dropper, and QtBot's process-scanning loop kills execution when it detects analysis tools - so defenders inheriting the older VBA-era playbook are facing a loader built specifically to shut down their investigation.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026