QakBot Named a 2026 Top Malware Threat: An IoC Analysis

An analysis¹ of QakBot, recently named one of the top malware threats to watch in 2026, highlighted its continued role as a highly effective access trojan and loader. Commonly delivered through phishing emails, QakBot is used to harvest credentials, maintain command-and-control access, move laterally across networks, and deploy secondary payloads, including ransomware. Its operations predominantly target enterprise environments with heavy email reliance, making it a persistent threat despite repeated takedown efforts.

The IoCs used in this analysis were sourced from a Trellix-published list², from which we extracted 929 unique domains. After removing legitimate but potentially compromised infrastructure, the dataset was reduced to 492 domains. We then focused on 125 domains and 19 subdomains, resulting in 144 IoCs analyzed.

Our investigation led to these discoveries:

• 15 unique client IP addresses communicated with 18 of the domains identified as IoCs
• Eight of the domains identified as IoCs were registered with malicious intent from the get-go
• 11,325 email-connected domains, nine of which turned out to be malicious
• 108 IP addresses, 60 of which turned out to be malicious
• 1,595 IP-connected domains, one of which turned out to be malicious
• 1,404 string-connected domains, one of which turned out to be malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.cloudsek.com/knowledge-base/most-dangerous-malware-threats
• [2] https://www.trellix.com/assets/docs/qakbot-iocs.pdf