Windows XP flaws help Russian 'Qbot' gang build 500,000 PC botnet

But are botnets becoming yesterday's worry?

The Russian gang behind the obscure Qbot botnet have quietly built an impressive empire of 500,000 infected PCs by exploiting unpatched flaws in mainly US-based Windows XP and Windows 7 computers, researchers at security firm Proofpoint have discovered.

A year or two ago, what the Qbot (aka Qakbot) campaign has achieved in the roughly half dozen years the actors behind it have been operating would have been seen as a major concern. Recently, standards have gone up a notch.

These days Russian hackers are grabbing headlines for altogether more serious incursions such as the recently revealed attack on US bank JPMorgan Chase, and botnets sound like yesterday's problem.

However, Proofpoint's research does point to an intriguingly sophisticated business model. The group behind the botnet have built it in a methodical way over time, fuelling the campaign at levels low enough to avoid attracting the attention of security firms.

The MO is to target, compromise and harvest legitimate Wordpress sites using bought-in credentials, even exploiting newsletters from these sites to spread drive-by malware links. From this, users with vulnerable browsers or software (Java, Reader, Flash) of the sort that can be hit by exploit kits to infect machines using droppers in chosen geographical locations.

What the attackers are after is online banking logins, which form half the business, and PCs that can be sold on to other criminals as compromised machines inside interesting organisations. These can also then be used a proxies for third-party attacks.

They seem keen to protect this nice little business, going to some lengths to regenerate different pieces of the attack chain every time anti-virus engines have started to detect it.

Perhaps the real story is the incredible ease with which Qbot has found victims, 75 percent of which are based in the US. Significantly, 52 percent of these are running Windows XP, 39 percent Windows 7 with 7 percent Windows Vista.

The UK's Qbot population of infected PCs is smaller but a still not insignificant 15,000, the firm's figures show.

"With 500,000 infected clients stealing online banking account credentials for as many as 800,000 online banking accounts, this cybercrime group has the potential for tremendous profits," said the researchers in their teardown.

Proofpoint advises on remediation in general terms but frankly this seems a bit of a desperate plea. Anyone who uses XP and still can't patch the old software on their system is probably beyond reach. More useful is the detailed advice to Wordpress site owners to detect and clean their assets of infection.

Join the CSO newsletter!

Error: Please check your email address.

Tags Personal TechproofpointsecurityWordpress

More about Proofpoint

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E. Dunn

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts