Bajrang Mane

Today morning around 8:17 am, we became aware of a false positive detection on excel files and the same getting quarantined on some customer devices. We sincerely regret the inconvenience caused. We immediately took necessary actions investigating the matter, thereby initiating a root cause analysis, and are working with the impacted customers. We would like to share that this issue was promptly resolved by 2:26 pm.

QBot, also known as Qakbot, QuackBot, and Pinkslipbot, is a Banking Trojan that was first observed in 2007. Today, Qbot is still a vicious and persistent threat to organizations and has become one of the leading Banking Trojans globally. Over the years, it has changed its initial techniques to deliver payloads like using VBA macros, Excel 4 macros, VBS files, exploits like Follina, etc. Recently in Quick Heal’s Security Labs, we have come across a new technique that QBot leverages for its attack.

The Qualys Research Team has observed a new version of Chaos ransomware in development. This blog reviews the malware’s updated functionality as well as its ongoing evolution. A ransomware builder called Chaos is still actively under development. The fourth version has recently been observed being improved, as identified in underground forums as well as code leaks in other community sites. While the builder bills itself as ransomware, its functions are more like wiper malware.