AP

FBI and European partners seize major malware network in blow to global cybercrime

Aug 29, 2023, 3:02 PM | Updated: 3:05 pm

U.S. Attorney Martin Estrada announces in Los Angeles on Tuesday, Aug. 29, 2023 the multinational t...

U.S. Attorney Martin Estrada announces in Los Angeles on Tuesday, Aug. 29, 2023 the multinational take down operation of Qakbot malware. In their latest disruption of global cybercrime, the FBI and partners in Europe infiltrated and seized control of a major malware network that was used for more than 15 years to commit a gamut of online crimes including crippling ransomware attacks. (Sarah Reingewirtz/The Orange County Register via AP)
Credit: ASSOCIATED PRESS

(Sarah Reingewirtz/The Orange County Register via AP)

LOS ANGELES (AP) — U.S. officials said Tuesday that the FBI and its European partners infiltrated and seized control of a major malware network used for more than 15 years to commit a gamut of online crimes including crippling ransomware attacks.

They then remotely removed the malicious software agent — known as Qakbot — from thousands of infected computers.

Cybersecurity experts said they were impressed by the deft dismantling of the network but cautioned that any setback to cybercrime would likely be temporary.

“Nearly ever sector of the economy has been victimized by Qakbot,” Martin Estrada, the U.S. attorney in Los Angeles, said Tuesday in announcing the takedown. He said the criminal network had facilitated about 40 ransomware attacks alone over 18 months that investigators said netted Qakbot administrators about $58 million.

Qakbot’s ransomware victims included an Illinois-based engineering firm, financial services organizations in Alabama and Kansas, along with a Maryland defense manufacturer and a Southern California food distribution company, Estrada said.

Officials said $8.6 million in cybercurrency was seized or frozen but no arrests were announced.

Estrada said the investigation is ongoing. He would not say where administrators of the malware, which could be marshaled into a botnet of zombie computers, were located. Cybersecurity researchers say they are believed to be in Russia and/or other former Soviet states.

Officials estimated the so-called malware loader, also known as Pinkslipbot and Qbot, was leveraged to cause hundreds of millions of dollars in damage since first appearing in 2008 as an information-stealing bank trojan. They said millions of people in nearly every country in the world have been affected.

Typically delivered via phishing email infections, Qakbot gave criminal hackers initial access to violated computers. They could then deploy additional payloads including ransomware, steal sensitive information or gather intelligence on victims to facilitate financial fraud and crimes such as tech support and romance scams.

The Qakbot network was “literally feeding the global cybercrime supply chain,” said Donald Alway, assistant director in charge of the FBI’s Los Angeles office, calling it “one of the most devastating cybercriminal tools in history.”

In the first half of 2023, Qakbot accounted for about 30% of such attacks globally, according to one cybersecurity firm’s study. Such “initial access” tools allow extortionist ransomware gangs to skip the initial step of penetrating computer networks, making them major facilitators for the far-flung mostly Russian-speaking criminals who have wreaked havoc by stealing data and disrupting schools, hospitals, local governments and businesses worldwide.

Beginning Friday in an operation officials dubbed “Duck Hunt,” the FBI along with Europol and law enforcement and justice partners in France, the United Kingdom, Germany, the Netherlands, Romania and Latvia seized more than 50 Qakbot servers and identified more than 700,000 infected computers, more than 200,000 of them in the U.S. — effectively cutting off criminals from their quarry.

The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers. A senior FBI official, briefing reporters on condition he not be further identified, called that number “fluid” and cautioned that other malware may have remained on machines liberated from Qakbot.

It was the FBI’s biggest success against cybercrooks since it “hacked the hackers” with the January takedown of the prolific Hive ransomware gang.

“It is an impressive takedown. Qakbot was the largest botnet” in number of victims, said Alex Holden, founder of Milwaukee-based Hold Security. But he said it may have been a victim of its own success in its staggering growth over the past few years. “Large botnets today tend to implode as too many threat actors are mining this data for various types of abuse.”

Cybersecurity expert Chester Wisniewski at Sophos agreed that while there could be a temporary drop in ransomware attacks, the criminals can be expected to either revive infrastructure elsewhere or move to other botnets.

“This will cause a lot of disruption to some gangs in the short term, but it will do nothing from it being rebooted,” he said. “Albeit it takes a long time to recruit 700,000 PCs.”


Bajak reported from Boston.

 

KSL 5 TV Live

AP

Curator Lily Carhart shows a pipette they used to extract liquid from a few dozen 18th-century glas...

Associated Press

No lie: Perfectly preserved centuries-old cherries unearthed at George Washington’s Mount Vernon

George Washington never did cut down the cherry tree, despite the famous story to the contrary, but he did pack away quite a few bottles of the fruit at his Mount Vernon home.

17 hours ago

FILE - A sign outside the Internal Revenue Service building in Washington, on May 4, 2021. Most tax...

Josh Boak and Fatima Hussein

The IRS wants to end another major tax loophole for the wealthy and raise $50 billion in the process

The IRS plans to end another major tax loophole that could raise more than $50 billion in revenue over the next decade.

22 hours ago

FILE: Dr. Vivek H. Murthy speaks onstage at The Archewell Foundation Parents’ Summit: Mental Well...

Michelle Chapman, AP Business Writer

Surgeon general asks Congress to require warning labels for social media, like those on cigarettes

The U.S. surgeon general has called on Congress to require warning labels on social media platforms similar to those now mandatory on cigarette boxes.

1 day ago

Firefighters are engaging in a wildfire in Gorman near Hungry Valley Park, moving southeast towards...

Ryan Sun

Crews working in sweltering conditions and steep terrain battle major Los Angeles-area wildfire

Strong winds are pushing flames from a wildfire through dry brush in mountains along Interstate 5 north of Los Angeles.

1 day ago

The Junkers Ju 52 aircraft "Kaleva" by the Finnish airline Aero is parked at the Katajanokka seapla...

Jari Tanner, The Associated Press

Remains of Finnish WWII plane shot down by Moscow with a US diplomat aboard is found

The World War II mystery of what happened to a Finnish passenger plane after it was shot down over the Baltic Sea by Soviet bombers appears to finally be solved more than eight decades later.

2 days ago

This image released by Disney/Pixar shows Joy, voiced by Amy Poehler, left, and Anxiety, voiced by ...

Lindsey Bahr, The Associated Press

‘Inside Out 2’ scores massive $155 million opening

Hollywood’s summer movie anxieties gave way to joy this weekend with the massive debut of Disney and Pixar’s “ Inside Out 2.” The animated sequel earned $155 million in ticket sales from 4,440 theaters in the U.S. and Canada, according to studio estimates Sunday.

2 days ago

Sponsored Articles

Photo courtesy of Artists of Ballet West...

Ballet West

The rising demand for ballet tickets: why they’re harder to get

Ballet West’s box office is experiencing demand they’ve never seen before, leaving many interested patrons unable to secure tickets they want.

Electrician repairing ceiling fan with lamps indoors...

Lighting Design

Stay cool this summer with ceiling fans

When used correctly, ceiling fans help circulate cool and warm air. They can also help you save on utilities.

Side view at diverse group of children sitting in row at school classroom and using laptops...

PC Laptops

5 internet safety tips for kids

Read these tips about internet safety for kids so that your children can use this tool for learning and discovery in positive ways.

Women hold card for scanning key card to access Photocopier Security system concept...

Les Olson

Why printer security should be top of mind for your business

Connected printers have vulnerable endpoints that are an easy target for cyber thieves. Protect your business with these tips.

Modern chandelier hanging from a white slanted ceiling with windows in the backgruond...

Lighting Design

Light up your home with these top lighting trends for 2024

Check out the latest lighting design trends for 2024 and tips on how you can incorporate them into your home.

Technician woman fixing hardware of desktop computer. Close up....

PC Laptops

Tips for hassle-free computer repairs

Experiencing a glitch in your computer can be frustrating, but with these tips you can have your computer repaired without the stress.

FBI and European partners seize major malware network in blow to global cybercrime