The U.S. authorities has indicted Russian nationwide Rustam Rafailevich Gallyamov, the chief of the Qakbot botnet malware operation that compromised over 700,000 computer systems and enabled ransomware assaults.
As per court docket paperwork, Gallyamov began to develop Qakbot (also called Qbot and Pinkslipbot) in 2008 and deployed it to create a community of hundreds of contaminated computer systems.
Over time, a group of builders was shaped round Qakbot however the indictment notes that different malware was additionally created beneath Gallyamov’s management.
For a few decade, Gallyamov used Qakbot as a banking trojan with worm capabilities, malware dropper, or backdoor that would additionally document keystrokes.
Beginning in 2019, Qakbot grew to become the preliminary an infection vector in lots of ransomware assaults from notorious gangs akin to Conti, ProLock, Egregor, REvil, RansomExx, MegaCortex, Doppelpaymer, Black Basta, and Cactus.
For offering preliminary entry, Gallyamov allegedly obtained a portion of the ransom paid by the victims. The fee diversified primarily based on an association with every ransomware group.
Over $24 million seized in digital belongings
In line with the indictment, Qakbot infections led to a whole bunch of ransomware victims throughout the globe. The record contains non-public corporations, healthcare suppliers, and authorities businesses.
The compromises induced a whole bunch of hundreds of thousands of {dollars} in injury. In simply 18 months, monetary damages exceeded $58 million.
In 2023, the Qakbot botnet was dismantled by the FBI, after hacking components of its infrastructure and taking management of 1 laptop utilized by a Qakbot administrator.
Regardless of this, Gallyamov continued malicious operations and “orchestrated spam bomb assaults in opposition to victims in the USA as lately as January 2025.”
Earlier at the moment, the Justice Division filed a forfeiture criticism in opposition to greater than $24 million in cryptocurrency seized from Gallyamov through the investigation.
Final month, the FBI seized extra unlawful belongings – 30 bitcoins and $700,000 in USDT tokens, value greater than $4 million at at the moment’s change price.
Regulation enforcement actions had been taken together with Operation Endgame, a world effort that led to seizing greater than 100 servers utilized by a number of botnets and malware loaders (e.g. IcedID, Pikabot, Trickbot, Bumblebee, Smokeloader, and SystemBC).
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and find out how to defend in opposition to them.
