Over 700,000 infected machines, 40 major ransomware attacks, 58 million US dollars in damage – that was Qakbot's track record before law enforcement moved in. Operation "Duck Hunt", led by the FBI in cooperation with Europol and Germany's BKA, took control of the infrastructure and removed the malware from victim machines. The case illustrates how modern botnets operate – and why the story doesn't end with the takedown.
What Is Qakbot?
Qakbot (a.k.a. Qbot, Pinkslipbot) is a banking trojan active since 2008 that evolved into a Malware-as-a-Service platform. It serves as an initial access point into victim networks and was purchased by several ransomware groups as their "way in" to target environments.
Operation Duck Hunt at a Glance
- Qakbot supplied initial access to ransomware groups including Conti, ProLock, Egregor, and REvil.
- Victims ranged from US financial institutions to medical device manufacturers worldwide.
- About 9 million USD in cryptocurrency was seized.
- The malware was remotely removed from infected machines – an internationally coordinated operation.
How to Check if You're Affected
- Check your email address on Have I Been Pwned and the Dutch National Police check portal.
- Review endpoint logs for typical Qakbot indicators (persistence in %AppData%, unusual regsvr32 / rundll32 invocations, suspicious DNS lookups).
- When in doubt: forensic analysis, not just "virus removed" – see our article on DFIR.
Update: Qakbot Is Back
Shortly after the successful operation, Qakbot reappeared – with adapted infrastructure, new evasion techniques, and further-developed phishing chains. This underlines an unwelcome pattern: takedowns dismantle infrastructure, not actors. With source code, know-how, and partner networks intact, operations get rebuilt.
What to Watch For Now
- New delivery chains: HTML smuggling, OneNote attachments, LNK files instead of Office macros.
- Better evasion: Longer sleep phases, sandbox detection, stronger encryption of communications.
- Partnerships: Handoff to ransomware groups remains the core business.
- Global distribution: No concentration on specific regions or sectors.
Preventive Measures
- Up-to-date EDR on every endpoint; behavioral detection instead of pure signature matching.
- Restrictive Office macro policies; block LNK and ISO attachments at the email gateway.
- Multi-factor authentication for all privileged and remote-accessible accounts.
- Regular, role-based awareness training and phishing simulations.
- Offline and immutable backups, tested restore scenarios.
- Ransomware incident response playbooks kept ready.
Conclusion
Qakbot's return is the uncomfortable lesson from Duck Hunt: takedowns matter, but they don't solve the problem permanently. Defense stays a continuous process – prevention, detection, and response combined. Watch the perimeter, the endpoints, and the people in equal measure, and you don't just push the next wave back – you see it coming earlier.