Trusted Design

The return of Qbot

概要

Qbot, also known as Qakbot, is a network-aware worm with backdoor capabilities, primarily designed as a credential harvester. It is an old threat and was well-described by Symantec back in 2009.1 The company later released a whitepaper which described Qbot version 910 in great detail.2 In December 2015, several researchers reported that websites hosting the Rig Exploit Kit were serving an updated version of Qbot.3 4 5 Then in January 2016, over 500 devices at a large public organisation were infected with Qbot: the worm was back, and it was both more and less effective. While all versions of Microsoft Windows the worm touched in the attack were compromised, a number of Windows XP machines crashed and failed to restart: despite its renewed potency, the programmers behind Qbot hadn’t built their bot to be compatible with older versions of Windows.

Created: 2026-02-23

Indicators

類似Pulses

The Return of Qbot (score: 0.92)
ISC 2015-12-30: Actor using Rig EK to deliver Qbot - update (score: 0.65)
Qakbot - A capable banking trojan (score: 0.63)
Threat Spotlight: The Return of Qakbot Malware (score: 0.60)
MTA 2015-12-31: ACTOR USING RIG EK TO DELIVER QBOT (score: 0.58)

このPulseに関連する脅威アクター (事実ベース)

Gamaredon Group

Score: 6.94

Matched TTPs:

T1061 - Graphical User Interface
T1547.002 - Authentication Package

MITREへのリンク →

Gorgon Group

Score: 3.15

Matched TTPs:

T1001 - Data Obfuscation

MITREへのリンク →

Threat Group-3390

Score: 6.97

Matched TTPs:

T1001 - Data Obfuscation
T1059.012 - Hypervisor CLI
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Patchwork

Score: 6.97

Matched TTPs:

T1001 - Data Obfuscation
T1059.012 - Hypervisor CLI
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

BlackByte

Score: 3.15

Matched TTPs:

T1001 - Data Obfuscation

MITREへのリンク →

TA2541

Score: 7.95

Matched TTPs:

T1001 - Data Obfuscation
T1128 - Netsh Helper DLL
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

menuPass

Score: 3.15

Matched TTPs:

T1001 - Data Obfuscation

MITREへのリンク →

Kimsuky

Score: 18.33

Matched TTPs:

T1001 - Data Obfuscation
T1027.014 - Polymorphic Code
T1547.002 - Authentication Package
T1537 - Transfer Data to Cloud Account
T1126 - Network Share Connection Removal
T1003.003 - NTDS

MITREへのリンク →

Cobalt Group

Score: 5.49

Matched TTPs:

T1027.014 - Polymorphic Code
T1128 - Netsh Helper DLL

MITREへのリンク →

Storm-0501

Score: 4.80

Matched TTPs:

T1027.014 - Polymorphic Code
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Leviathan

Score: 7.34

Matched TTPs:

T1027.014 - Polymorphic Code
T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

APT32

Score: 4.51

Matched TTPs:

T1027.014 - Polymorphic Code
T1059.012 - Hypervisor CLI

MITREへのリンク →

APT19

Score: 4.51

Matched TTPs:

T1027.014 - Polymorphic Code
T1059.012 - Hypervisor CLI

MITREへのリンク →

APT37

Score: 4.16

Matched TTPs:

T1547.002 - Authentication Package
T1059.012 - Hypervisor CLI

MITREへのリンク →

Lazarus Group

Score: 7.00

Matched TTPs:

T1547.002 - Authentication Package
T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

APT39

Score: 4.45

Matched TTPs:

T1547.002 - Authentication Package
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Magic Hound

Score: 4.16

Matched TTPs:

T1547.002 - Authentication Package
T1059.012 - Hypervisor CLI

MITREへのリンク →

Turla

Score: 10.62

Matched TTPs:

T1547.002 - Authentication Package
T1556.009 - Conditional Access Policies
T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

Sandworm Team

Score: 5.23

Matched TTPs:

T1547.002 - Authentication Package
T1546.016 - Installer Packages

MITREへのリンク →

APT28

Score: 8.70

Matched TTPs:

T1547.002 - Authentication Package
T1059.012 - Hypervisor CLI
T1546.007 - Netsh Helper DLL

MITREへのリンク →

ZIRCONIUM

Score: 4.45

Matched TTPs:

T1547.002 - Authentication Package
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Medusa Group

Score: 4.80

Matched TTPs:

T1128 - Netsh Helper DLL
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

OilRig

Score: 6.37

Matched TTPs:

T1128 - Netsh Helper DLL
T1556.009 - Conditional Access Policies

MITREへのリンク →

APT29

Score: 11.13

Matched TTPs:

T1218.009 - Regsvcs/Regasm
T1555.004 - Windows Credential Manager
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Stealth Falcon

Score: 3.62

Matched TTPs:

T1556.009 - Conditional Access Policies

MITREへのリンク →

Wizard Spider

Score: 3.62

Matched TTPs:

T1556.009 - Conditional Access Policies

MITREへのリンク →

Earth Lusca

Score: 4.60

Matched TTPs:

T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

APT38

Score: 3.82

Matched TTPs:

T1059.012 - Hypervisor CLI
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Dragonfly

Score: 4.60

Matched TTPs:

T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

Dark Caracal

Score: 3.82

Matched TTPs:

T1059.012 - Hypervisor CLI
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Elderwood

Score: 3.82

Matched TTPs:

T1059.012 - Hypervisor CLI
T1537 - Transfer Data to Cloud Account

MITREへのリンク →

Mustard Tempest

Score: 6.30

Matched TTPs:

T1059.012 - Hypervisor CLI
T1543.002 - Systemd Service

MITREへのリンク →

Daggerfly

Score: 4.60

Matched TTPs:

T1059.012 - Hypervisor CLI
T1546.016 - Installer Packages

MITREへのリンク →

Volt Typhoon

Score: 4.89

Matched TTPs:

T1537 - Transfer Data to Cloud Account
T1546.016 - Installer Packages

MITREへのリンク →

Contagious Interview

Score: 3.84

Matched TTPs:

T1126 - Network Share Connection Removal

MITREへのリンク →

Moonstone Sleet

Score: 3.84

Matched TTPs:

T1126 - Network Share Connection Removal

MITREへのリンク →

Ember Bear

Score: 4.13

Matched TTPs:

T1003.003 - NTDS

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.74

Matched TTPs:

T1537 - Transfer Data to Cloud Account
T1001 - Data Obfuscation
T1547.002 - Authentication Package
T1003.003 - NTDS
T1126 - Network Share Connection Removal
T1027.014 - Polymorphic Code

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る