Operation ‘Duck Hunt’ Dismantles Qakbot

U.S. authorities Tuesday said they permanently dismantled the notorious Qakbot botnet in an international operation that seized 52 servers and nearly $9 million worth of cryptocurrency.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

The botnet, also known as Qbot, was a vector for ransomware, and it “has ceased to operate,” said Don Alway, the assistant director in charge of the FBI’s Los Angeles Field Office, during a press conference.

Law enforcement identified more than 700,000 computers infected with the Qakbot malware, including more than 200,000 in the United States.

The FBI dubbed the operation behind the takedown “Duck Hunt,” a play on the Qakbot moniker. The operation is “the most significant technological and financial operation ever led by the Department of Justice against a botnet,” said United States Attorney Martin Estrada of the Central District of California. International partners in the investigation include France, Germany, the Netherlands, the United Kingdom, Romania and Latvia.

Qakbot played a role in approximately 40 different ransomware attacks over the past 18 months that caused $58 million in losses, Estrada said. “You can imagine that the losses have been many millions more through the life of the Qakbot,” which cyber defenders first detected in 2008, Estrada added.

“Today, all that ends,” he said. Online criminal gangs that have used Qakbot to spread ransomware include Conti, ProLock, Egregor, REvil, MegaCortex and Black Basta.

Investigators seized control of servers used to manage the botnet and, after redirecting online traffic to servers controlled by authorities, downloaded onto infected computers a file untethering them from Qakbot, states an FBI affidavit submitted in Los Angeles federal court.

Prosecutors declined to identify the cybercrimnal organization behind Qakbot, citing a need for secrecy in an ongoing investigation.

Authorities say they will use the seized $8.6 million of cryptocurrency to refund victims.

This is a developing story. Check back for updates.