FBI makes a massive botnet infecting more than 700,000 computers uninstall itsel...
source link: https://www.theverge.com/2023/8/29/23851227/fbi-doj-qakbot-botnet-malware
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
FBI makes a massive botnet infecting more than 700,000 computers uninstall itself
/“Operation Duck Hunt” targeted Qakbot malware that remotely controls computers and sets them up for other attacks, like ransomware.
By Emma Roth, a news writer who covers the streaming wars, consumer tech, crypto, social media, and much more. Previously, she was a writer and editor at MUO.
Share this story
:format(webp)/cdn.vox-cdn.com/uploads/chorus_asset/file/23318438/akrales_220309_4977_0305.jpg)
The US government just helped dismantle a massive network of computers infected with one of the world’s most notorious pieces of malware. According to the FBI, a multinational effort led by the US took down Qakbot, a malware that made its way into over 700,000 computers around the globe.
Hackers typically target victims with Qakbot by sending them spam emails containing malicious attachments or links. As soon as a victim downloads the attachment or clicks the link, Qakbot infects their computer, which then becomes part of a botnet — or a network of infected computers controlled remotely by hackers. From there, bad actors can install additional malware on their victims’ devices, such as ransomware.
To take down the network, the FBI routed Qakbot through FBI-controlled servers, where it instructed infected computers in the US and elsewhere to download software that uninstalled the Qakbot malware. The installer also separated infected computers from the botnet, “preventing further installation of malware through Qakbot.” As noted by the DOJ, the action was only limited to the malware installed by Qakbot actors and “did not extend to remediating other malware already installed on the victim computers.”
In addition to the US, Operation “Duck Hunt” also involved Europol, France, Germany, the Netherlands, the UK, Romania, and Latvia. The US says the botnet was responsible for hundreds of millions of dollars in damages and infected more than 200,000 computers in the US. Qakbot has been around since 2008 and was leveraged by several prolific ransomware groups in the past, including Conti, REvil, MegaCortex, and more. As part of the operation, the DOJ seized $8.6 million worth of extorted funds in crypto.
“An international partnership led by the Justice Department and the FBI has resulted in the dismantling of Qakbot, one of the most notorious botnets ever, responsible for massive losses to victims around the world,” US Attorney Martin Estrada says in a statement. “Qakbot was the botnet of choice for some of the most infamous ransomware gangs, but we have now taken it out.”
The FBI has since provided Have I Been Pwned with the compromised credentials it found during the operation, allowing you to enter your email on the site to check if you were affected. The Dutch National Police has also added affected credentials to its Check Your Hack site.
Recommend
-
10
29 April 2021 / sysrv Threat Alert: New update from Sysrv-hello, now infecting victims‘ webpages to push malicious ex...
-
7
Everything you need to know about the Pegasus spyware infecting smartphonesAnd how to tell if your iPhone is infected.Photo: NSO Group/Cult of MacNSO Group’s Pegasus spyware is making headlines again after it was reported th...
-
9
Most of the following article was completed around early 2020, at that time the vendor was trying different ways to recover the massive amount of infected devices, we shared our findings with the vendor, as well as to CNCERT, and decided to n...
-
6
A nice story about Unix processes "infecting" each other I once worked at a place that had an interesting little problem stemming from the way they managed machines and some of the fun side-effects processes can have on each other...
-
4
Chaos: a powerful malware infecting multiple systems and architectures Malicious software can infect Windows, Linux, FreeBSD and several chip architectures By
-
7
A dummy’s guide to infecting your Mac with malware ...
-
9
ONGOING ATTACK CAMPAIGN — Hackers are mass infecting servers worldwide by exploiting a patched hole Servers running unpatched versions of ESXi are sitting ducks for ESXiArg...
-
3
'Mylobot' botnet infecting 50,000 devices per day worldwide...
-
5
PERSISTENCE — Malware infecting widely used security appliance survives firmware updates Update-resistant malware is part of a pattern by highly motivated threat actors.
-
7
37 Comments - Add comment ...
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK