In a significant joint effort, an international law enforcement operation led by the US Department of Justice has successfully dismantled the infamous “Qakbot” malware platform. Qakbot, first discovered over a decade ago, has been widely utilized by cybercriminals for various financial crimes.
The operation, codenamed “Duck Hunt,” was a collaborative effort involving the Federal Bureau of Investigation (FBI) and several countries, including France, Germany, the Netherlands, Britain, Romania, and Latvia. Qakbot malware has traditionally been disseminated through malicious emails, targeting unsuspecting victims.
This takedown is considered the most significant technological and financial operation led by the US Department of Justice against a botnet—a network of compromised computers used by hackers to distribute malware. The operation has thwarted future attacks and prevented untold victims from falling prey to Qakbot.
Law enforcement agencies seized 52 servers both within the United States and internationally
Qakbot’s origin is believed to be in Russia, and it has affected organizations worldwide, spanning from Germany to Argentina. The malware infected over 700,000 victim computers, leading to extensive ransomware deployments and causing substantial financial damage to businesses, healthcare providers, and government agencies.
Law enforcement agencies seized 52 servers both within the United States and internationally as part of the operation. The investigation revealed that Qakbot administrators received approximately $58 million in ransoms paid by victims between October 2021 and April 2023.
To disrupt the cybercrime network, the FBI redirected Qakbot’s internet traffic to their controlled servers, effectively removing the malware from victim computers. The FBI emphasized that this process did not involve viewing or collecting personal information, but rather the active removal of malicious files from private systems.
FBI Director Christopher Wray noted that victims ranged from financial institutions to government contractors and medical device manufacturers, highlighting the far-reaching impact of Qakbot. This international collaboration has led to a major victory against cybercriminals by dismantling Qakbot’s infrastructure, thereby neutralizing its criminal activities and safeguarding numerous potential victims.
