{"id":28069,"date":"2021-09-21T12:35:14","date_gmt":"2021-09-21T09:35:14","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=28069"},"modified":"2026-03-27T23:17:36","modified_gmt":"2026-03-27T20:17:36","slug":"qakbot-banking-malware-is-on-the-rise-number-of-attacked-users-grew-65-in-2021","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/qakbot-banking-malware-is-on-the-rise-number-of-attacked-users-grew-65-in-2021\/","title":{"rendered":"QakBot banking malware is on the rise: number of attacked users grew 65% in 2021"},"content":{"rendered":"\n

20 September 2021<\/p>\n\n\n\n

The number of users attacked with QakBot \u2013 a powerful banking Trojan, in the first seven months of 2021 grew by 65% in comparison to the same period in 2020 and reached 17,316 users worldwide, demonstrating that this threat is increasingly affecting internet users. This rise has drawn the attention of Kaspersky researchers to the subject, leading them to review updates to the latest version of this Trojan. <\/strong><\/p>\n\n\n\n

.<\/p>\n\n\n\n

Number of Kaspersky users encountering QakBot: seven months of 2020 vs. seven months of 2021 (Source: Kaspersky Security Network)<\/em><\/p>\n\n\n\n

Banking Trojans, when they have successfully infected a targeted computer, allow cybercriminals to steal money from victims\u2019 online banking accounts and e-wallets \u2013 which is why they are considered one of the most dangerous types of malware. QakBot was identified as early as 2007 as one of the many banking Trojans. However, in recent years, QakBot\u2019s developer has invested a lot into its development, turning this Trojan into one of the most powerful and dangerous among existing examples of this malware type. <\/p>\n\n\n\n

In addition to functions that are quite standard for banking Trojans, like keylogging, cookie-stealing, passwords, and login grabbing, recent versions of QakBot have included functionalities and techniques allowing it to detect if it is running in a virtual environment. The latter is often used by security solutions and anti-malware specialists to identify malware via its behavior. Now, if the malware detects it\u2019s running in a virtual environment, it can stop suspicious activity or stop functioning completely. In addition, QakBot tries to protect itself from being analyzed and debugged by experts and automated tools.<\/p>\n\n\n\n

The other new and unusual function spotted by Kaspersky researchers in recent versions of QakBot is its ability to steal emails from the attacked machine. These emails are later used in various social engineering campaigns against users in the victim\u2019s email contact list. <\/p>\n\n\n\n

\u201cQakBot is unlikely to stop its activity anytime soon. This malware continuously receives updates and the threat actors behind it keep adding new capabilities and updating its modules in order to maximize the revenue impact, along with stealing details and information. Previously, we\u2019ve seen QakBot being actively spread via the Emotet botnet. This botnet was taken down at the beginning of the year, but judging by the infection attempt statistics, which have grown in comparison to the last year, the actors behind QakBot have found a new way of propagating this malicious software,\u201d<\/em> said Haim Zigel, malware analyst at Kaspersky.<\/p>\n\n\n\n

Kaspersky security solutions successfully detect and block all known versions of the QakBot banking Trojan. <\/p>\n\n\n\n

Learn more about QakBot on Securelist<\/a>.<\/p>\n\n\n\n

To stay safe from financial threats like QakBot, Kaspersky experts recommend that you:
<\/strong><\/p>\n\n\n\n