Netskope Threat Labs

QakBot

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

QakBot (a.k.a. Quakbot, QBot) is a modular malware family active since 2007 that grew from a banking trojan into one of the most prolific loaders for serious intrusions. It steals sensitive financial data through web injects and form grabbing, and it downloads payloads such as Cobalt Strike and ransomware onto corporate networks. Delivered through phishing and search poisoning, the botnet survived repeated takedown attempts, including a major law enforcement disruption in 2023, and rebuilt infrastructure keeps it active.

Stats

First seen
January 2022
Last seen
October 2026

Also known as

PinkslipbotQBotQakbotQakbotLNKQakbotPackerQbotQbotLNKQuakbot

MITRE ATT&CK techniques

71 techniques across 11 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

  • T1543Create or Modify System Process
  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0006 Credential Access

  • T1110Brute Force
  • T1539Steal Web Session Cookie
  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1010Application Window Discovery
  • T1016System Network Configuration Discovery
  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1033System Owner/User Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1069Permission Groups Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1120Peripheral Device Discovery
  • T1124System Time Discovery
  • T1135Network Share Discovery
  • T1482Domain Trust Discovery
  • T1518Software Discovery
  • T1518Software Discovery

TA0008 Lateral Movement

  • T1091Replication Through Removable Media
  • T1210Exploitation of Remote Services

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
Archive-ZIP.Backdoor.Qbot
DeepScan:Generic.HTA.Qakbot.G.FFFFFFFE
DeepScan:Generic.HTA.Qakbot.K.FFFFFFFE
Document-Excel.Backdoor.Qakbot
Document-Excel.Backdoor.Qbot
Document-Excel.Backdoor.Quakbot
Document-Excel.Downloader.Qakbot
Document-Excel.Downloader.Quakbot
Document-HTML.Backdoor.Qakbot
Document-HTML.Backdoor.Qbot

Related IPS Signatures

Signature Name
MALWARE-CNC Generic.Qakbot.c2 traffic detected
MALWARE-CNC QakBot.Generic.Get traffic detected
MALWARE-CNC QakBot.Generic.Post traffic detected
MALWARE-CNC Win.Trojan.Qakbot variant beaconing attempt
MALWARE-CNC Win.Trojan.Qakbot variant outbound connection
MALWARE-CNC Win.Trojan.Qbot outbound connection attempt
MALWARE-OTHER QAKBOT Distribution Detected
MALWARE-OTHER Win.Dropper.Qakbot-7058183-0 download attempt
MALWARE-OTHER Win.Malware.Qbot variant download attempt
MALWARE-OTHER Win.Trojan.Qakbot variant download attempt

Related blogs

Related families

TrickBotInvisiMoleCobalt StrikeBazarPlugX

References