Over 700,000 infected machines. 40 major ransomware attacks. 58 million US dollars in damage. That was Qakbot's track record before law enforcement stepped in. The FBI led Operation "Duck Hunt" together with Europol and Germany's BKA. They took control of the botnet's infrastructure and removed the malware from victim machines.
The case shows how modern botnets work. It also shows why the story does not end with the takedown.
What Is Qakbot?
Qakbot (a.k.a. Qbot, Pinkslipbot) is a banking trojan. It has been active since 2008 and grew into a Malware-as-a-Service platform. Attackers used it as a first entry point into victim networks. Several ransomware groups bought access through Qakbot as their "way in" to target systems.
Operation Duck Hunt at a Glance
- Qakbot sold first access to ransomware groups such as Conti, ProLock, Egregor and REvil.
- Victims ranged from US banks and financial firms to makers of medical devices around the world.
- Police seized about 9 million USD in cryptocurrency.
- The malware was removed from infected machines remotely. Many countries worked together on the operation.
How to Check if You're Affected
- Check your email address on Have I Been Pwned and on the check portal of the Dutch National Police.
- Look through your endpoint logs for typical signs of Qakbot. These include persistence in %AppData%, odd regsvr32 / rundll32 calls and suspicious DNS lookups.
- If in doubt, run a forensic analysis. Do not stop at "virus removed". See our article on DFIR.
Update: Qakbot Is Back
Shortly after the operation, Qakbot came back. It had new infrastructure, new ways to evade detection and better phishing chains. This follows a familiar pattern. A takedown breaks the infrastructure, but not the people behind it. They still have the source code, the know-how and their partner networks. So they can rebuild.
What to Watch For Now
- New delivery chains: HTML smuggling, OneNote attachments and LNK files take the place of Office macros.
- Better evasion: Longer sleep phases, sandbox detection and stronger encryption of its traffic.
- Partnerships: Handing off access to ransomware groups is still the core business.
- Global spread: No focus on any one region or sector.
Preventive Measures
- Keep EDR up to date on every endpoint. Use behavior-based detection, not just signature matching.
- Set strict rules for Office macros. Block LNK and ISO attachments at the email gateway.
- Use multi-factor authentication for all privileged accounts and all accounts with remote access.
- Run regular awareness training for each role, plus phishing simulations.
- Keep offline and immutable backups, and test how you restore them.
- Have ransomware incident response playbooks ready.
Conclusion
Qakbot's return is the hard lesson from Duck Hunt. Takedowns matter, but they do not solve the problem for good. Defense is an ongoing process that combines prevention, detection and response. Watch the perimeter, the endpoints and the people in equal measure. Then you will not just push the next wave back. You will see it coming sooner.