Pinkslipbot

Pinkslipbot, also known as Qakbot, QBot or QuackBot, is a modular information-stealing malware that has been active since 2008. Initially emerging in 2007 as a banking trojan, it targeted financial institutions to steal sensitive data. Over the years, however, its functionality evolved and diversified, expanding its reach to various industries. The malware was linked to at least 40 ransomware attacks against global companies, healthcare providers, and government agencies, causing hundreds of millions of dollars in damage based on conservative estimates. In early April 2024, there was a significant increase in attacks using the QBot malware. It had become the initial access method of choice for several high-profile ransomware gangs, including REvil, Black Basta, Conti, Egregor, and MegaCortex. These cybercriminal groups utilized the advanced malware strain to prepare newly compromised networks for ransomware infestations. Additionally, techniques once used by the QakBot trojan were leveraged in a widespread phishing campaign involving the DarkGate and PikaBot strains, targeting various industries. However, in August 2023, the QakBot malware operation faced disruption by the FBI during a coordinated law enforcement effort codenamed Operation Duck Hunt. This operation resulted in the dismantling of the botnet, which had infected around 700,000 computers globally. Despite this setback, the tactics employed by the QakBot trojan live on in other malware attacks, demonstrating the persistent and evolving threat posed by such malicious software.