Introduction
Crowdstrike tarcks the operators behind the Qbot as MALLARD SPIDER
Activities and Tactics
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
- 2020-03
- 2020-04
- 2020-05
- 2020-08
- 2020-09
- 2020-10
- 2020-11
- 2020-12
- FBI issues second alert about ProLock ransomware stealing data
- FBI warns of ProLock ransomware decryptor not working properly
- ProLock Ransomware teams up with QakBot trojan for network access
- ProLock ransomware increases payment demand and victim count
- PwndLocker Fixes Crypto Bug
- QBot malware is back replacing IcedID in malspam campaigns
- QBot partners with Egregor ransomware in bot-fueled attacks
- QBot phishing lures victims using US election interference emails
- QBot uses Windows Defender Antivirus phishing bait to infect PCs
- Qbot malware switched to stealthy new Windows autostart method
- Qbot steals your email threads again to infect other victims
- Ransomware Attack Renders LaSalle County Government Computers Unusable
- Ransomware Hit ATM Giant Diebold Nixdorf
- Rebrands as ProLock Ransomware
- https://chicago.cbslocal.com/2020/03/04/ransomware-attack-renders-lasalle-county-government-computers-unusable/
- https://krebsonsecurity.com/2020/05/ransomware-hit-atm-giant-diebold-nixdorf/
- https://www.bleepingcomputer.com/news/security/fbi-issues-second-alert-about-prolock-ransomware-stealing-data/
- https://www.bleepingcomputer.com/news/security/fbi-warns-of-prolock-ransomware-decryptor-not-working-properly/
- https://www.bleepingcomputer.com/news/security/prolock-ransomware-increases-payment-demand-and-victim-count/
- https://www.bleepingcomputer.com/news/security/prolock-ransomware-teams-up-with-qakbot-trojan-for-network-access/
- https://www.bleepingcomputer.com/news/security/pwndlocker-fixes-crypto-bug-rebrands-as-prolock-ransomware/
- https://www.bleepingcomputer.com/news/security/qbot-malware-is-back-replacing-icedid-in-malspam-campaigns/
- https://www.bleepingcomputer.com/news/security/qbot-malware-switched-to-stealthy-new-windows-autostart-method/
- https://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/
- https://www.bleepingcomputer.com/news/security/qbot-phishing-lures-victims-using-us-election-interference-emails/
- https://www.bleepingcomputer.com/news/security/qbot-steals-your-email-threads-again-to-infect-other-victims/
- https://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Egregor:
- Mimikatz:
- ProLock:
- QakBot:
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
References pending cataloguing.