FBI, European partners take down Qakbot malware network

“We’ve seized 52 servers in the United States and abroad. By seizing these servers, we’re preventing Qakbot from resurrecting to cause further additional harm,” U.S. Attorney for the Central District of California Martin Estrada said on Tuesday, Aug. 29. “Through this operation, we’ve recovered from the Qakbot criminal organization over 6.5 million credentials, victim credentials. Now, these victim credentials are things such as email logins and passwords, very sensitive information that these victims may have no idea were stolen from them.”

According to Estrada, the malware network had facilitated about 40 ransomware attacks alone over 18 months, netting Qakbot administrators about $58 million. Victims included an Illinois-based engineering firm, financial services organizations in Alabama and Kansas, along with a Maryland defense manufacturer and a Southern California food distribution company.

“Qakbot was the botnet of choice for some of the most infamous ransomware gangs,” Estrada said.

No arrests were announced in relation to the FBI’s takedown of the Qakbot malware network. Estrada would not say where administrators of the malware were located.

Cybersecurity researchers have said these administrators are believed to be in Russia and/or other former Soviet states. Estrada said the investigation was ongoing.

“Cybercriminals who rely on malware like Qakbot to steal private data from innocent victims have been reminded today that they do not operate outside the bounds of the law,” Garland said in his Tuesday statement.