Spammers use Squirrelwaffle malware to drop Qakbot, Cobalt Strike

guest · Oct 26, 2021

Spammers use Squirrelwaffle malware to drop Cobalt Strike
October 26, 2021
https://www.bleepingcomputer.com/ne...squirrelwaffle-malware-to-drop-cobalt-strike/

A new malware threat named Squirrelwaffle has emerged in the wild, supporting actors with an initial foothold and a way to drop malware onto compromised systems and networks.

The new malware tool spreads via spam campaigns dropping Qakbot and Cobalt Strike in the most recent campaigns.
Click to expand...

This new threat first appeared in September 2021, with distribution volumes peaking at the end of that month. While the spam campaign primarily uses stolen reply-chain email campaigns in English, the threat actors also utilize French, German, Dutch, and Polish emails.

These emails contain hyperlinks to malicious ZIP archives hosted on attacker-controlled web servers and typically include a malicious .doc or a .xls attachment that runs malware-retrieving code if opened.
Click to expand...

The Squirrelwaffle loader then deploys malware like Qakbot or the widely abused penetration testing tool Cobalt Strike.
Cobalt Strike is a legitimate penetration testing tool designed as an attack framework to test an organization's infrastructure to discover security gaps and vulnerabilities.

Squirrelwaffle also features an IP blocklist that is populated with notable security research firms as a way to evade detection and analysis.
Click to expand...

As such, Squirrelwaffle may be a reboot of Emotet by members who dodged law enforcement or other threat actors attempting to fill the void left behind by the notorious malware.
Click to expand...

Cisco Talos: SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Recently, a new threat, referred to as "SQUIRRELWAFFLE" is being spread more widely via spam campaigns, infecting systems with a new malware loader. This is a malware family that's been spread with increasing regularity and could become the next big player in the spam space.

SQUIRRELWAFFLE provides threat actors with an initial foothold onto systems and their network environments that can then be used to facilitate further compromise or additional malware infections depending on how adversaries choose to attempt to monetize their access. In many cases, these infections are also being used to deliver and infect systems with other malware like Qakbot and the penetration-testing tool Cobalt Strike.
Click to expand...

Let's take a look at how this new threat operates and the volume and characteristics of the malicious email campaigns associated with it. Organizations should be aware of this threat, as it will likely persist across the threat landscape for the foreseeable future.
Click to expand...

guest · Nov 12, 2021

QBot returns for a new wave of infections using Squirrelwaffle
November 12, 2021
https://www.bleepingcomputer.com/ne...-new-wave-of-infections-using-squirrelwaffle/

The activity of the QBot (also known as Quakbot) banking trojan is spiking again, and analysts from multiple security research firms attribute this to the rise of Squirrelwaffle.

Squirrelwaffle emerged last month as one of the most likely candidates to fill the void left by the take-down of Emotet, and unfortunately, these predictions are quickly being confirmed.
Click to expand...

A new wave of attacks
Researchers at TrendMicro have observed a new distribution campaign for QBot relying on Visual Basic Macros (VBA) macros in Microsoft Word documents sent as attachments in phishing emails.
Previous Qbot campaigns used Excel macros, which are still present in some cases, even if they are more scarce now.

Qbot is also known to partner with ransomware operations to provide them with initial access to a network. QBot has previously collaborated with ransomware gangs to deploy REvil, Egregor, ProLock, PwndLocker, and MegaCortex strains.
Click to expand...

Riding the Squirrel
Sentinel Labs published a report on the rise of the SquirrelWaffle malware loader, linking it directly to QBot, which is dropped as second stage malware.

Researchers at Minerva Labs have also drawn a similar conclusion, seeing the following delivery scheme: [...]
SquirrelWaffle also uses VBA macros to execute a PowerShell command that retrieves its payload and launches it.
Click to expand...

Trend Micro: QAKBOT Loader Returns With New Techniques and Tools

QAKBOT operators resumed email spam operations towards the end of September after an almost three-month hiatus. QAKBOT detection has become a precursor to many critical and widespread ransomware attacks. Our report shares some insight into the new techniques and tools this threat is using.
Click to expand...

Minerva: A New DatopLoader Delivers QakBot Trojan

A new phishing campaign delivers a Qakbot (also known as Qbot or Quakbot), using DatopLoader(aka Squirrelwaffle).

DatopLoader( aka Squirrelwaffle) compromises victims via a malspam campaign and provides threat actors with the initial foothold into systems and victims' network environments. This can then be used to facilitate further compromises or additional malware infections, which depends on how adversaries wish to monetize their access.
Yesterday (November 8, 2021), we spotted a malicious excel file trying to execute three different files using regsvr32.exe: [...]
Click to expand...

Sentinel Labs: Is SquirrelWaffle the New Emotet? How to Detect the Latest MalSpam Loader

Since early September, SentinelLabs has been tracking the rapid rise of a new malware loader that previous researchers have dubbed “SquirrelWaffle”. The tool has been utilized in multiple global attacks since then and is being likened to Emotet in the way it is being used to conduct massive malspam campaigns.

In this post, we explain how SquirrelWaffle works, what to look out for and how to protect your business from the latest malspam loader.
Click to expand...

Log in or Sign up

Spammers use Squirrelwaffle malware to drop Qakbot, Cobalt Strike

guest Guest

guest Guest

Log in or Sign up

Spammers use Squirrelwaffle malware to drop Qakbot, Cobalt Strike

guest Guest

guest Guest

Useful Searches