SQUIRRELWAFFLE Malspam Campaigns Deliver Qakbot and Cobalt Strike
Summary
Cisco Talos details SQUIRRELWAFFLE malspam campaigns that use stolen email threads and malicious Office documents to infect systems, then deliver Qakbot or Cobalt Strike. The article analyzes the loader, C2, and evasion methods.
Key points
- Campaigns observed from mid-September 2021 used replies to stolen email threads linking to malicious ZIP archives containing Word or Excel documents.
- Document macros retrieved the SQUIRRELWAFFLE DLL; execution used rundll32.exe or regsvr32.exe.
- The loader established an initial foothold and was observed delivering Qakbot and Cobalt Strike.
- Its C2 used HTTP POST requests with XOR-obfuscated, Base64-encoded data, including host and user information.
- Operators used compromised web servers, IP blocklists, and filtering to restrict analysis and hinder detection.
- Talos recommended defense-in-depth and listed detection coverage, including Snort SIDs 58277–58281 and ClamAV signatures.
Article Details
- Attack Vectors
- Malspam replies hijack existing email threads and use hyperlinks to deliver malicious ZIP archives containing Word or Excel documents.
- Word documents use AutoOpen macros to write and execute a VBS script; Excel spreadsheets use Excel4 macros to retrieve and execute the SQUIRRELWAFFLE payload.
- The loader is executed through rundll32.exe or regsvr32.exe and can deliver additional malware, including Qakbot and Cobalt Strike.
- Defensive Notes
- The article recommends defense-in-depth controls to prevent, detect, or respond to SQUIRRELWAFFLE campaigns.
- Cisco lists detection and blocking coverage across Secure Endpoint, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Secure Web Appliance, Duo, Snort, and ClamAV.
- The article notes that distribution infrastructure may restrict access based on IP address, provider, or geographic information, complicating automated analysis.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware's C2 data is XOR-obfuscated and Base64-encoded; Word macros also use string reversal to obfuscate code.T1041 · Exfiltration Over C2 ChannelThe malware sends victim-system information, including hostname, username, and workstation configuration, to its C2 server.T1059.005 · Visual BasicWord macros write and execute a VBS script that retrieves the SQUIRRELWAFFLE payload.T1071.001 · Web ProtocolsThe malware communicates with its C2 server using HTTP POST requests.T1105 · Ingress Tool TransferMacros and the VBS script retrieve the SQUIRRELWAFFLE DLL, and the C2 channel can deliver secondary payloads.T1204.002 · Malicious FileVictims open malicious Office documents and, in the Word-document chain, enable macros to initiate infection.T1218.010 · Regsvr32The SQUIRRELWAFFLE DLL can be executed using regsvr32.exe.T1218.011 · Rundll32The SQUIRRELWAFFLE DLL can be executed using rundll32.exe.T1566.002 · Spearphishing LinkMalspam messages contain hyperlinks that direct victims to malicious ZIP archives.
People
Malware
AzoRultIn one case, we also identified a SQL dump related to an AZORult panel present on the same host being used as a C2 server by SQUIRRELWAFFLE.Cobalt StrikeSQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt StrikeEmotetconstantly changing as new threats emerge or existing threats evolve over time. Over the past few years, Emotet has been one of the primary threats being delivered via malicious spam campaigns as we have previouslyQakbotSQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt StrikeSquirrelwaffleSQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.ClamAVThe following ClamAV signatures have been released to detect this threat:DocuSigncampaigns was a Microsoft Word document. In this case it was made to appear as if it was associated with DocuSign, a popular document sharing and signing platform that is often used for a variety of purposes related toMicrosoft Exceldocuments have varied across campaigns, in all cases, they are either Microsoft Word documents or Microsoft Excel spreadsheets. These documents contain the malicious code responsible for retrieving and executing theMicrosoft OfficeBeginning in mid-September 2021, we observed malspam campaigns being used to deliver malicious Microsoft Office documents that function as the initial stage of the infection process and are used to infect systems withMicrosoft WordOffice document. While these documents have varied across campaigns, in all cases, they are either Microsoft Word documents or Microsoft Excel spreadsheets. These documents contain the malicious code responsible forSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.The following Snort SIDs have been released to detect this threat: 58277 -UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.WordPressThese malware distribution campaigns appear to be taking advantage of previously compromised web servers, primarily running versions of the WordPress content management system (CMS).