Feds take down malware botnet that contaminated 200,000 U.S. computer systems

Federal regulation enforcement officers have disrupted a malware generally known as Qakbot — a pc code utilized by cybercriminals to commit ransomware, monetary fraud and different cyber crimes resulting in large losses worldwide, with a Southern California food-distribution firm among the many victims, they introduced on Tuesday, Aug. 29.

The Qakbot malware contaminated greater than 700,000 sufferer computer systems worldwide, with 200,000 of these within the U.S., federal authorities stated throughout a press convention in downtown Los Angeles, earlier than its infrastructure was taken down.

The malware was being deleted from these computer systems, stopping it from doing extra hurt.

The operation additionally concerned actions in France, Germany, the Netherlands, the UK, Romania and Latvia. The Division of Justice stated authorities had seized greater than $8.6 million in cryptocurrency in illicit income.

It’s the most important United States-led monetary and technical disruption of an unlawful botnet infrastructure, in line with the Division of Justice.

“A world partnership led by the Justice Division and the FBI has resulted within the dismantling of Qakbot, probably the most infamous botnets ever, answerable for large losses to victims world wide,” stated Martin Estrada, a U.S. legal professional.

Qakbot, managed by a cybercriminal group, was used to focus on essential industries nationwide by sending spam e-mail messages containing malicious attachments or hyperlinks, stated Thom Mrozek, a spokesman for the U.S. Lawyer’s Workplace.

Qakbot can then ship further malware, together with ransomware, used to hunt funds in bitcoin earlier than returning entry to the sufferer’s laptop networks, Mrozek stated.

As soon as a sufferer laptop is contaminated, it turns into a part of a botnet, or robotic community. Cybercriminals then have distant entry to the entire contaminated computer systems in a coordinated method, Mrozek stated.

House owners and operators of the sufferer computer systems are often unaware of the an infection.

Up to now yr, criminals not but tied to Qakbot attacked computer systems of the San Bernardino County Sheriff’s Division, the Los Angeles Unified College District and hospitals run by Prospect Medical Holdings — “and by doing that, shut down emergency rooms and medical amenities all through the nation,” Estrada stated.

From October 2021 to April 2023, proof collected by investigators reveals Qakbot directors obtained $58 million in ransoms, Mrozek stated.