UNITED STATES NEWS

FBI and European partners seize major malware network in blow to global cybercrime

Aug 29, 2023, 1:35 PM

LOS ANGELES (AP) — U.S. officials said Tuesday that the FBI and its European partners infiltrated and seized control of a major malware network used for more than 15 years to commit a gamut of online crimes including crippling ransomware attacks.

They then remotely removed the malicious software agent — known as Qakbot — from thousands of infected computers.

Cybersecurity experts said they were impressed by the deft dismantling of the network but cautioned that any setback to cybercrime would likely be temporary.

“Nearly ever sector of the economy has been victimized by Qakbot,” Martin Estrada, the U.S. attorney in Los Angeles, said Tuesday in announcing the takedown. He said the criminal network had facilitated about 40 ransomware attacks alone over 18 months that investigators said netted Qakbot administrators about $58 million.

Qakbot’s ransomware victims included an Illinois-based engineering firm, financial services organizations in Alabama and Kansas, along with a Maryland defense manufacturer and a Southern California food distribution company, Estrada said.

Officials said $8.6 million in cybercurrency was seized or frozen but no arrests were announced.

Estrada said the investigation is ongoing. He would not say where administrators of the malware, which could be marshaled into a botnet of zombie computers, were located. Cybersecurity researchers say they are believed to be in Russia and/or other former Soviet states.

Officials estimated the so-called malware loader, also known as Pinkslipbot and Qbot, was leveraged to cause hundreds of millions of dollars in damage since first appearing in 2008 as an information-stealing bank trojan. They said millions of people in nearly every country in the world have been affected.

Typically delivered via phishing email infections, Qakbot gave criminal hackers initial access to violated computers. They could then deploy additional payloads including ransomware, steal sensitive information or gather intelligence on victims to facilitate financial fraud and crimes such as tech support and romance scams.

The Qakbot network was “literally feeding the global cybercrime supply chain,” said Donald Alway, assistant director in charge of the FBI’s Los Angeles office, calling it “one of the most devastating cybercriminal tools in history.”

In the first half of 2023, Qakbot accounted for about 30% of such attacks globally, according to one cybersecurity firm’s study. Such “initial access” tools allow extortionist ransomware gangs to skip the initial step of penetrating computer networks, making them major facilitators for the far-flung mostly Russian-speaking criminals who have wreaked havoc by stealing data and disrupting schools, hospitals, local governments and businesses worldwide.

Beginning Friday in an operation officials dubbed “Duck Hunt,” the FBI along with Europol and law enforcement and justice partners in France, the United Kingdom, Germany, the Netherlands, Romania and Latvia seized more than 50 Qakbot servers and identified more than 700,000 infected computers, more than 200,000 of them in the U.S. — effectively cutting off criminals from their quarry.

The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers. A senior FBI official, briefing reporters on condition he not be further identified, called that number “fluid” and cautioned that other malware may have remained on machines liberated from Qakbot.

It was the FBI’s biggest success against cybercrooks since it “hacked the hackers” with the January takedown of the prolific Hive ransomware gang.

“It is an impressive takedown. Qakbot was the largest botnet” in number of victims, said Alex Holden, founder of Milwaukee-based Hold Security. But he said it may have been a victim of its own success in its staggering growth over the past few years. “Large botnets today tend to implode as too many threat actors are mining this data for various types of abuse.”

Cybersecurity expert Chester Wisniewski at Sophos agreed that while there could be a temporary drop in ransomware attacks, the criminals can be expected to either revive infrastructure elsewhere or move to other botnets.

“This will cause a lot of disruption to some gangs in the short term, but it will do nothing from it being rebooted,” he said. “Albeit it takes a long time to recruit 700,000 PCs.”

___

Bajak reported from Boston.

United States News

Republican presidential candidate former President Donald Trump addresses the crowd at a campaign e...

Associated Press

What to know about the attempt on Trump’s life and its aftermath

The FBI is still trying to determine a motive behind Saturday’s attempt to assassinate former President Donald Trump, while the tone of this week’s Republican convention in Milwaukee likely will be dominated by the violence. A former fire chief who was killed at Trump’s Pennsylvania rally is being remembered as a “man of conviction.” The […]

1 hour ago

Associated Press

Mechanical issues prompt 2 Delta Air Lines flights to divert, return to airport

ST. LOUIS (AP) — Two Delta Air Lines flights were diverted over the weekend because of mechanical issues, the FAA said Monday. Delta flight 927, en route from Jackson Hole, Wyoming, to Atlanta, was diverted to St. Louis shortly before noon Saturday because of an issue with cabin pressure, the airline said in a statement. […]

2 hours ago

FILE - An overwhelmed residents surveys the damage following flooding caused by the remnants of Hur...

Associated Press

Vermont seeks federal damage assessment for floods caused by Hurricane Beryl’s remnants

MONTPELIER, Vt. (AP) — Vermont is seeking an assessment to determine whether last week’s flooding, which damaged homes, knocked down bridges and washed out roads, qualifies for a federal disaster declaration and aid. The flooding from the remnants of Hurricane Beryl happened a year after the state experienced catastrophic flooding that left some victims still […]

3 hours ago

In this image from video provided by the Senate Judiciary Committee, Aileen Cannon testifies virtua...

Associated Press

Federal judge dismisses Trump classified documents case

A federal judge dismissed Donald Trump's classified documents case over concerns about the appointment of the prosecutor.

3 hours ago

Republican presidential candidate former President Donald Trump speaks at a campaign event in Butle...

Associated Press

Federal judge dismisses Trump classified documents case over concerns with prosecutor’s appointment

WASHINGTON (AP) — The federal judge presiding over the classified documents case of former President Donald Trump in Florida has dismissed the prosecution because of concerns over the appointment of the prosecutor who brought the case. U.S. District Judge Aileen Cannon granted the defense motion to dismiss the case on Monday. Lawyers for Trump had […]

3 hours ago

FILE - Simone Biles and the U.S. women celebrate as the 2024 team is named at the United States Gym...

Associated Press

US Olympic fundraising team sets audacious goal of raising $500 million by 2028

The fundraising arm for the U.S. Olympic team is revving up a donation drive aimed at raising $500 million by the time the Summer Olympics return to Los Angeles in 2028. Organizers rolled out the program Monday, hoping to use the momentum of this year’s Olympics, which begin July 26, to bring in funds for […]

4 hours ago

Sponsored Articles

...

Midwestern University

Midwestern University Clinic visits boost student training & community health

Going to a Midwestern University Clinic can help make you feel good in more ways than one.

...

Condor Airlines

Condor Airlines can get you smoothly from Phoenix to Frankfurt on new A330-900neo airplane

Adventure Awaits! And there's no better way to experience the vacation of your dreams than traveling with Condor Airlines.

...

Collins Comfort Masters

Here’s 1 way to ensure your family is drinking safe water

Water is maybe one of the most important resources in our lives, and especially if you have kids, you want them to have access to safe water.

FBI and European partners seize major malware network in blow to global cybercrime