FBI-Led Operation Disrupts Qakbot Infrastructure; Huntress Details Prior Defensive “Vaccine”
Summary
The FBI and international partners disrupted Qakbot infrastructure. Huntress also describes how it used a Windows Defender sandbox artifact to block new infections on partner endpoints, while cautioning that Qakbot could return.
Key points
- The FBI said Operation Duck Hunt redirected Qakbot traffic through FBI-controlled servers to deliver a file that uninstalled the malware from infected computers.
- The FBI reported protecting more than 700,000 infected computers, seizing $8.6 million in cryptocurrency, and dismantling infrastructure used by ransomware groups.
- Huntress researchers found that Qakbot stopped executing when it detected the Windows Defender sandbox artifact C:\INTERNAL\__EMPTY.
- Huntress deployed that file to partner endpoints as a “vaccine” after testing it against multiple Qakbot samples; the company reported that new infection reports fell to nearly zero by late December 2022.
- Huntress cautioned that the takedown might hinder Qakbot but would not necessarily prevent its operators from rebuilding infrastructure or resuming activity. The FBI’s removal code was available on VirusTotal.
Article Details
- Event Type
- Law-enforcement disruption of the Qakbot botnet, alongside Huntress’s previously developed defensive measure against Qakbot infections.
- Impact
- The FBI and international partners redirected Qakbot traffic through FBI-controlled servers and instructed infected computers to download a file that would remove Qakbot. The FBI said the operation protected more than 700,000 infected computers, seized $8.6 million in cryptocurrency, and dismantled infrastructure used by ransomware groups. Separately, Huntress reported that deploying a file-based “vaccine” to partner endpoints reduced new Qakbot infection reports to nearly zero by the end of December 2022.
MITRE ATT&CK
People
John GoedertCredited for contributions to Huntress’s Qakbot vaccine creation and rollout.John HammondAuthor of the article.Kris LitmanCredited for contributions to Huntress’s Qakbot vaccine creation and rollout.Matthew BrennanHuntress reverse engineer credited with uncovering Qakbot’s check for the C:\INTERNAL\__EMPTY file.Myles KeoughCredited for contributions to Huntress’s Qakbot vaccine creation and rollout.Rob NoethCredited for contributions to Huntress’s Qakbot vaccine creation and rollout.Sharon MartinCredited for contributions to Huntress’s Qakbot vaccine creation and rollout.
Malware
Vendors
Products
Countries
Francestatement from the Justice Department states that the collaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.Germanyfrom the Justice Department states that the collaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.Latviaeffort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.Romaniacollaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.the NetherlandsJustice Department states that the collaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.the United Kingdomstates that the collaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.United Statespublic release statement from the Justice Department states that the collaborative effort between the United States, France, Germany, the Netherlands, the United Kingdom, Romania and Latvia made this operation possible.