Loading story…
The U.S. Department of Justice announced a multinational operation on August 29, 2023, that disrupted QakBot, a botnet that had infected more than 700,000 computers worldwide, and seized more than $8.6 million in cryptocurrency profits. The FBI redirected botnet traffic to servers under its control and instructed infected computers to download a law-enforcement-developed QakBot uninstaller. QakBot, also known as QBot, was a banking trojan used to obtain initial access and deliver additional malware, including ransomware associated with groups such as Black Basta.
The FBI and Dutch National Police also identified compromised credentials and made resources available for victims to check their exposure. The operation disrupted a major malware-delivery platform, but its lasting impact remained uncertain. Organizations should continue monitoring for QakBot-related activity, investigate potentially affected endpoints for additional malware, and reset exposed credentials; removing QakBot does not establish that other payloads or attacker access have been eliminated.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On August 29, 2023, the U.S. Department of Justice announced the disruption of QakBot, which had infected more than 700,000 computers worldwide, and the seizure of more than $8.6 million in cryptocurrency. The FBI redirected botnet traffic to controlled servers and instructed infected computers to download a law-enforcement-created QakBot uninstaller.
On March 15, 2023, ReliaQuest discovered a Black Basta security incident in which the attacker used QakBot for initial access. The attacker established a foothold in only 77 minutes.
The FBI and Dutch National Police identified compromised account credentials associated with QakBot and supplied them to Have I Been Pwned. Victims were directed to Have I Been Pwned and the Dutch police's Check Your Hack service to check for compromised credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. and international law enforcement dismantled the **Qakbot** botnet by seizing control of key infrastructure, redirecting infected systems to FBI-controlled servers, and remotely pushing an uninstaller to compromised Windows hosts. Court records show the FBI obtained authority to use remote access techniques against U.S.-based computers communicating with Qakbot, a long-running malware platform also known as **Qbot** and **Pinkslipbot**, after identifying roughly **700,000 infected computers worldwide**, including about **200,000 in the United States**. The operation collected limited technical data such as IP and routing information, but did not capture communication content. Researchers said the disruption also neutralized active infections by sending Qakbot’s own shutdown command through its named-pipe mechanism, preventing the malware from relaunching after a reboot. The takedown targeted a botnet widely used as an initial access platform for ransomware groups including **Conti**, **REvil**, **Egregor**, **MegaCortex**, **ProLock**, and **Black Basta**. Investigators linked Qakbot operators to fees associated with about **$58 million** in victim ransom payments between October 2021 and April 2023, underscoring the botnet’s central role in corporate intrusions and downstream ransomware attacks.
Aug 15, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026
Threat actors used **QakBot** (also tracked as **QBot/QuackBot**) as an initial access and post-compromise platform in corporate intrusions, delivering the malware through phishing campaigns that evolved from malicious Office documents to password-protected ZIP archives, **MSI** installers, **OneNote** files, **LNK/XLL** payloads, and script-based chains. Across these campaigns, QakBot established persistence, injected into legitimate processes, conducted host and domain reconnaissance, stole credentials and other data, and communicated with command-and-control servers over encrypted HTTP/HTTPS channels before staging additional payloads.
Aug 15, 2026