Windows Follina zero-day now being abused to infect PCs with Qbot malware
Qbot is also being used as a dropper to target Windows devices
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Follina is turning out to be quite a threat for system admins everywhere, as new reports are coming in of the vulnerability being used to distribute infostealers, trojans, and ransomware.
Cybersecurity researchers from Proofpoint found threat actors known as TA570 using the Follina flaw to infectendpointswith Qbot, while NCC Group found it being further abused by Black Basta, a known ransomware group.
Qbot, known also as Qakbot, Quakbot, or Pinkslipbot, is a banking trojan, and infostealer, that’s been in use for more than ten years now. Threat actors looking to distribute the infostealer usually go for a combination of phishing and vulnerability exploiting, tricking people into visiting malicious websites which, through various vulnerabilities, end up downloading the trojan onto the device.
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Black Basta emerges
Qbot is capable of dealing plenty of damage, logging keys, exfiltrating cookies, hooking processes, but also acting as a dropper for stage-two viruses,malware, or ransomware. This is exactly the hand that Black Basta is playing.
A relatively new entrant into the ransomware space, Black Basta was observed by NCC Group, using Qbot to move laterally through compromised networks, and deploying itsransomware.
The group first appeared in April this year, going straight for the American Dental Association, the publication reminds. It uses double-extortion tactics (stealing and encrypting sensitive data) to force victims into paying the ransom.
Qbot malware found smuggled inside Windows Installer packages>This notorious malware has returned after months away>Microsoft Excel is making a big change to protect against malware
Follina, also tracked as CVE-2022-30190, is a flaw found in the Windows Support Diagnostic Tool. It can be abused to remotely run code, by getting programs such as Office Word to bring up the tool from a specially crafted document, when opened.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Microsoftacknowledged the existence of the flaw and promised it was working on a fix. Until that happens, threat actors are actively using the flaw. Among the confirmed attacks are one against the international Tibetan community, conducted by a known Chinese state-sponsored threat actor called TA413.
Via:The Register
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Windows PCs targeted by new malware hitting a vulnerable driver
Dangerous Android banking malware looks to trick victims with fake money transfers
Latest Google Pixel update includes surprise launch of Android 15’s best battery feature
