UNITED STATES NEWS

FBI and European partners seize major malware network in blow to global cybercrime

Aug 29, 2023, 1:35 PM

U.S. Attorney Martin Estrada announces in Los Angeles on Tuesday, Aug. 29, 2023 the multinational t...

U.S. Attorney Martin Estrada announces in Los Angeles on Tuesday, Aug. 29, 2023 the multinational take down operation of Qakbot malware. In their latest disruption of global cybercrime, the FBI and partners in Europe infiltrated and seized control of a major malware network that was used for more than 15 years to commit a gamut of online crimes including crippling ransomware attacks. (Sarah Reingewirtz/The Orange County Register via AP)
Credit: ASSOCIATED PRESS

(Sarah Reingewirtz/The Orange County Register via AP)

LOS ANGELES (AP) — U.S. officials said Tuesday that the FBI and its European partners infiltrated and seized control of a major malware network used for more than 15 years to commit a gamut of online crimes including crippling ransomware attacks.

They then remotely removed the malicious software agent — known as Qakbot — from thousands of infected computers.

Cybersecurity experts said they were impressed by the deft dismantling of the network but cautioned that any setback to cybercrime would likely be temporary.

“Nearly ever sector of the economy has been victimized by Qakbot,” Martin Estrada, the U.S. attorney in Los Angeles, said Tuesday in announcing the takedown. He said the criminal network had facilitated about 40 ransomware attacks alone over 18 months that investigators said netted Qakbot administrators about $58 million.

Qakbot’s ransomware victims included an Illinois-based engineering firm, financial services organizations in Alabama and Kansas, along with a Maryland defense manufacturer and a Southern California food distribution company, Estrada said.

Officials said $8.6 million in cybercurrency was seized or frozen but no arrests were announced.

Estrada said the investigation is ongoing. He would not say where administrators of the malware, which could be marshaled into a botnet of zombie computers, were located. Cybersecurity researchers say they are believed to be in Russia and/or other former Soviet states.

Officials estimated the so-called malware loader, also known as Pinkslipbot and Qbot, was leveraged to cause hundreds of millions of dollars in damage since first appearing in 2008 as an information-stealing bank trojan. They said millions of people in nearly every country in the world have been affected.

Typically delivered via phishing email infections, Qakbot gave criminal hackers initial access to violated computers. They could then deploy additional payloads including ransomware, steal sensitive information or gather intelligence on victims to facilitate financial fraud and crimes such as tech support and romance scams.

The Qakbot network was “literally feeding the global cybercrime supply chain,” said Donald Alway, assistant director in charge of the FBI’s Los Angeles office, calling it “one of the most devastating cybercriminal tools in history.”

In the first half of 2023, Qakbot accounted for about 30% of such attacks globally, according to one cybersecurity firm’s study. Such “initial access” tools allow extortionist ransomware gangs to skip the initial step of penetrating computer networks, making them major facilitators for the far-flung mostly Russian-speaking criminals who have wreaked havoc by stealing data and disrupting schools, hospitals, local governments and businesses worldwide.

Beginning Friday in an operation officials dubbed “Duck Hunt,” the FBI along with Europol and law enforcement and justice partners in France, the United Kingdom, Germany, the Netherlands, Romania and Latvia seized more than 50 Qakbot servers and identified more than 700,000 infected computers, more than 200,000 of them in the U.S. — effectively cutting off criminals from their quarry.

The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers. A senior FBI official, briefing reporters on condition he not be further identified, called that number “fluid” and cautioned that other malware may have remained on machines liberated from Qakbot.

It was the FBI’s biggest success against cybercrooks since it “hacked the hackers” with the January takedown of the prolific Hive ransomware gang.

“It is an impressive takedown. Qakbot was the largest botnet” in number of victims, said Alex Holden, founder of Milwaukee-based Hold Security. But he said it may have been a victim of its own success in its staggering growth over the past few years. “Large botnets today tend to implode as too many threat actors are mining this data for various types of abuse.”

Cybersecurity expert Chester Wisniewski at Sophos agreed that while there could be a temporary drop in ransomware attacks, the criminals can be expected to either revive infrastructure elsewhere or move to other botnets.

“This will cause a lot of disruption to some gangs in the short term, but it will do nothing from it being rebooted,” he said. “Albeit it takes a long time to recruit 700,000 PCs.”

___

Bajak reported from Boston.

United States News

Associated Press

YouTuber who staged California plane crash gets 6 months in prison for obstructing investigation

LOS ANGELES (AP) — An influencer who staged a California plane crash to make a YouTube video of himself parachuting to safety was sentenced Monday to six months in federal prison for obstructing the investigation by destroying the wreckage, the U.S. Justice Department said Monday. Trevor Daniel Jacob, 30, an experienced pilot and skydiver, pleaded […]

26 minutes ago

Associated Press

Virginia police investigate explosion at house where officers were trying to serve a search warrant

ARLINGTON, Va. (AP) — Police in a Virginia suburb of the nation’s capital are investigating an explosion at a residence where officers were trying to serve a search warrant Monday. The Arlington County Police Department said in a statement that the suspect fired several shots inside the home and that an explosion happened. Firefighters were […]

1 hour ago

FILE - A hiring sign is displayed at a grocery store, Oct. 5, 2023, in Deerfield, Ill. Most busines...

Associated Press

Economists predict US inflation will keep cooling and the economy can avoid a recession

Most business economists think the U.S. economy could avoid a recession next year, even if the job market ends up weakening under the weight of high interest rates, according to a survey released Monday.

2 hours ago

Associated Press

Photographs capture humpback whale’s Seattle visit, breaching in waters in front of Space Needle

Seattle (AP) — Pictures released by a conservation group show a young humpback whale breaching in front of the Space Needle as it visited the waters off Seattle last week, capturing a rare display of wildlife next to a major city. The photos were also used to gauge the general health of the whale and […]

2 hours ago

FILE - President Joe Biden's son, Hunter Biden, leaves after a court appearance, July 26, 2023, in ...

Associated Press

Prosecutors push back against Hunter Biden’s move to subpoena Trump documents in gun case

WASHINGTON (AP) — Prosecutors pushed back Monday against Hunter Biden’s move to subpoena documents from Donald Trump and former Justice Department officials in the firearms case filed against the president’s son. They argued that Hunter Biden doesn’t have enough evidence to support his claims of potential political interference in the criminal investigation against him and […]

2 hours ago

(Maricopa County Sheriff's Office Photo)...

Associated Press

Treasury creates new strike force as US and China pursue crackdown on illicit fentanyl trafficking

The Treasury Department on Monday announced a new strike force to help combat illicit fentanyl trafficking as the U.S. and China step up stop efforts.

3 hours ago

Sponsored Articles

Follow @KTAR923...

West Hunsaker at Morris Hall supports Make-A-Wish Foundation in Arizona

KTAR's Community Spotlight this month focuses on Morris Hall and its commitment to supporting the Make-A-Wish Foundation in Arizona.

...

Desert Institute for Spine Care

Desert Institute for Spine Care (DISC) wants to help Valley residents address back, neck issues through awake spine surgery

As the weather begins to change, those with back issues can no longer rely on the dry heat to aid their backs. That's where DISC comes in.

...

DAY & NIGHT AIR CONDITIONING, HEATING AND PLUMBING

Importance of AC maintenance after Arizona’s excruciating heat wave

An air conditioning unit in Phoenix is vital to living a comfortable life inside, away from triple-digit heat.

FBI and European partners seize major malware network in blow to global cybercrime