View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
August 30, 2023

Cybercriminals duck for cover as ‘ticking bomb’ Qakbok botnet is dismantled by FBI

The botnet, used in widespread ransomware attacks, had infected more than 700,000 devices.

By Claudia Glover

Notorious botnet Qakbot, which has been used by some of the world’s most prolific ransomware gangs to launch attacks, has been taken down by the FBI in conjunction with police in the UK and Germany. The botnet had infected more than 700,000 devices worldwide and the FBI says it has seized cryptocurrency worth $8.6m as part of the raid. Security researchers have welcomed the news, describing Qakbot as “a ticking bomb” in the hands of cybercriminals.

Notorious botnet Qakbot taken down by the FBI. (Photo by Shutter_M/Shutterstock)

Law enforcement agencies in the Netherlands, Romania and Latvia also participated in Monday’s bust.

How the FBI sent Qakbot to the bottom of the pond

The FBI says it gained access to Qakbot’s network and was able to redirect traffic to bureau-controlled servers that instructed the 700,000 infected computers to download an uninstaller file. This untethered infected computers from the botnet and prevented the installation of any additional malware. 

“The FBI neutralised this far-reaching criminal supply chain, cutting it off at the knees,” said FBI director Christopher Wray. “The victims ranged from financial institutions on the east coast to a critical infrastructure government contractor in the midwest to a medical device manufacturer on the west coast.”

The botnet was used by numerous ransomware gangs including REvil, Ryuk and Black Basta. Bogdan Botezatu, director of threat research at security company Bitdefender, says Qakbot was a “ticking bomb” that had “been a pest” for the past decade. “It was very modular, very effective and quite versatile, some sort of a Swiss army knife of the cyber-underground,” Botezatu says. “Personally, I’m very happy with the news.”

Qakbot was primarily spread through spam emails, delivering additional malware, including ransomware. Other groups known to have used it include ProLock, Egregor and MegaCortex, according to a report by security company Reliaquest. It has been deployed to launch attacks on businesses and public sector organisations.

Researchers often felt they were playing a game of cat and mouse to try to take Qakbot offline, explains John Fokker, head of threat intelligence at Trellix Advanced Research Centre. “It was constantly evolving, adding new features, and finding new ways to evade detection, always skirting true take down, until now,” Fokker says. “It is great news that the FBI and partners were able to disrupt this very persistent botnet and hopefully it will stay offline for good.”

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

The process of taking down the botnet will not have been simple, Fokker says. “Combating cybercrime takes a respectable amount of dedication and collaboration to pull apart the intricacies of ransomware infrastructures,” he adds. “The increase in takedowns and arrests shows that cybercriminals need to watch their backs.”

FBI continues its assault on cybercriminals

Trellix’s Fokker says more similar operations are likely to be imminent, as the FBI has been active in its efforts to stop cybercriminals in recent weeks. Earlier this month, illegal web hosting service Lolek Hosted was taken down, having allegedly been used to distribute malware and help launch multiple distributed denial of service attacks. 

In April, dark web marketplace Genesis, where criminals could buy and sell stolen information on 80 million people, was taken offline in a global sting that involved officers from the UK NCA, the FBI and the Dutch National Police Corps. This led to the arrest of 120 people.

In January, ransomware gang Hive’s online infrastructure was seized in a sting led by the FBI and Europol. Officers obtained encryption keys that could help victims of the group retrieve stolen data and avoid paying ransoms totalling more than $100m. The dark web blog site for the gang was replaced with a seizure notice that said, “This hidden site has been seized. The Federal Bureau of Investigation seized this site as part of a coordinated law enforcement action.”

Read more: Barracuda network services remain at risk of cyberattack – FBI

Topics in this article :
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.