Loading story…
Qakbot has reappeared months after the law-enforcement-led Duck Hunt disruption, with researchers observing a new phishing campaign that targeted organizations in the hospitality sector. The activity used malicious PDF lures to deliver MSI installers containing a patched Internet Download Manager DLL and embedded Qakbot components, reviving a malware family long associated with credential theft, lateral movement, and follow-on ransomware operations.
Analysis of the new samples showed Qakbot relying on rundll32.exe, Acrobat-themed decoy behavior, and process hollowing into wermgr.exe to run its final payload from memory while attempting to evade detection. Researchers also highlighted Qakbot's continued use of RC4-encrypted Windows Registry entries to store victim identifiers and command-and-control data, a technique documented in separate analysis focused on decrypting the malware's encrypted registry keys and tracking its persistent tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft identified a new small-scale Qakbot phishing campaign beginning on December 11, 2023. The activity was described as specifically targeting the hospitality industry.
Security researchers observed Qakbot spreading through phishing emails in December 2023 using malicious PDFs that led to MSI downloads. The MSI contained a patched Internet Download Manager DLL packed with Qakbot components and used decoy Acrobat behavior and process hollowing into wermgr.exe.
Trellix reported a significant increase in Qbot activity during Q1 and Q2 2022, detecting about 500,000 Qbot URLs in its FAUDE system. The activity peaked in April 2022 with 189,313 detected URLs, reflecting widespread malspam-driven distribution.
Law enforcement disrupted Qakbot's distribution infrastructure in Operation Duck Hunt. Later reporting described Qakbot's return as occurring roughly four months after this disruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used **QakBot** (also tracked as **QBot/QuackBot**) as an initial access and post-compromise platform in corporate intrusions, delivering the malware through phishing campaigns that evolved from malicious Office documents to password-protected ZIP archives, **MSI** installers, **OneNote** files, **LNK/XLL** payloads, and script-based chains. Across these campaigns, QakBot established persistence, injected into legitimate processes, conducted host and domain reconnaissance, stole credentials and other data, and communicated with command-and-control servers over encrypted HTTP/HTTPS channels before staging additional payloads.
Aug 15, 2026
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026
QAKBOT resumed large-scale email spam activity after a roughly three-month pause, using hijacked email threads and malicious attachments to reestablish itself as an initial-access malware operation often seen before ransomware deployment. Researchers linked the activity to the distributor **TR**, which has also been associated with **SquirrelWaffle** delivery and reported **IMAP brute-force** operations, underscoring the role of spam-driven access brokers in broader intrusion chains. The renewed campaign introduced changes from earlier QAKBOT waves by combining **VBA macros** with **Excel 4.0 macros** in weaponized documents. The infection chain extracted embedded data, built a command to download a QAKBOT DLL from remote hosts, executed it through **`regsvr32.exe`** using the **`-silent`** parameter, and established persistence with a scheduled task. The malware has historically served as a precursor to ransomware incidents involving **MegaCortex, PwndLocker, Egregor, ProLock,** and **Sodinokibi/REvil**.
Aug 15, 2026