Trusted Design

ISC 2015-12-30: Actor using Rig EK to deliver Qbot - update

概要

A follow-up to a previous SANS Institute diary entry on the actor using Rig exploit kit (EK) to deliver Qbot. The author infected more Windows hosts from other compromised websites in order to obtain additional data about the actor. This actor has been delivering Qbot (also known as Qakbot) malware. The actor uses a gate to route traffic from the compromised website to the EK landing page. In this case, the gate returns a variable that is translated to a URL for the EK landing page. The sequence of events is: 1) User visits a website compromised by this actor; 2) An HTTP GET request for a .js file from the compromised site returns text with malicious script appended to it; 3) An HTTP GET request to the gate returns a variable used by the malicious script; and 4) The variable sent by the gate is decrypted, and an HTTP GET request for the EK landing page is sent.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• MTA 2015-12-31: ACTOR USING RIG EK TO DELIVER QBOT (score: 0.70)
• The Return of Qbot (score: 0.67)
• The return of Qbot (score: 0.65)
• MTA 2016-01-11: RIG EK FROM 46.30.43.79 SENDS QBOT (score: 0.64)
• MTA 2015-11-16: MALICIOUS SCRIPT BACKWARD URL LEADS TO RIG EK (score: 0.63)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る