Qakbot: How the FBI, NCA and other European officials broke notorious cybercrime hacking network
The FBI, NCA and other European crime officials have removed a network of malicious software from thousands of infected computers, US officials have said.
The Qakbot software – a piece of code that lurked unseen in the majority of the computers it had secretly installed itself on – was used as part of online crimes, including ransomware attacks, for more than 15 years.
The criminal network behind it made around $58m (£45.8m) from victims, between October 2021 and April 2023, officials said.
Victims included an Illinois-based engineering firm, financial services organisations in Alabama and Kansas, a Maryland defence manufacturer and a southern California food distribution company, Los Angeles US attorney Martin Estrada said.
“Nearly every sector of the economy has been victimised by Qakbot,” Mr Estrada said.
US Attorney Martin Estrada said Qakbot malware had infected more than 700,000 victim computers. Pic: AP
In an operation dubbed “Duck Hunt”, the FBI along with Europol and crime and justice officials in France, Germany, the Netherlands, Romania and Latvia, seized more than 50 Qakbot servers and identified more than 700,000 infected computers worldwide.
By doing this, criminals were effectively cut off from their source.
The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers.
In the UK, the National Crime Agency ensured the criminal network’s UK servers were taken offline on Saturday, at the same time as Qakbot’s other infrastructure elsewhere.
Will Lyne, Head of Cyber Intelligence at the NCA, said: “This investigation has taken out a prolific malware that caused significant damage to victims in the UK and around the world.
“Qakbot was a key enabler within the cyber crime ecosystem, facilitating ransomware attacks and other serious threats.”
Read more:
Electoral Commission targeted by cyber attack
University of Manchester says its data ‘likely copied’
Growth of ‘hackers for hire’
Researchers said they believed the cybercriminals were in Russia or other former Soviet states, but Mr Estrada did not say exactly where.
What is Qakbot?
First appearing in 2008, Qakbot gives criminal hackers initial access to violated computers.
Usually delivered via phishing email infections, criminals could then install additional ransomware, steal sensitive information or gather intelligence on victims to enable financial fraud and crimes such as tech support and romance scams.
FBI assistant director in charge, Don Alway. Pic: AP
Once infected, the computers became part of a botnet – a network of computers infected by malware and under the control of a single attacking party.
Qakbot affected one in 10 corporate networks and accounted for about 30% of global attacks, a pair of cybersecurity firms found.
The operation has been the biggest success for the FBI against cybercriminals, but experts warned that any setback to cybercrime would likely be temporary.
Chester Wisniewski, a cybersecurity expert at Sophos – a UK-based security software and hardware company – said that while there could be a temporary drop in ransomware attacks, the criminals are expected to either revive infrastructure elsewhere or move to other botnets.
“This will cause a lot of disruption to some gangs in the short term, but it will do nothing [to stop it] from being rebooted,” he said.
“Albeit it takes a long time to recruit 700,000 PCs.”
A workman saved a seven-year-old boy from a burning car in the aftermath of a deadly crash caused by a suicidal ex-pilot, an inquest has heard.
The schoolboy’s rescue came following the collision on the M6, which killed former RAF man Richard Woods and four others, in October last year.
Last week a coroner ruled that Woods, 40, took his own life by deliberately driving his Skoda the wrong way down the motorway while drunk and hitting a Toyota Yaris head-on.
The driver of the Toyota, Jaroslaw Rossa, 42, was also killed, along with his two sons, Filip, 15, and Dominic, seven, and his partner Jade McEnroe, 33.
Cockermouth Coroner’s Court heard on Thursday that Ms McEnroe’s son was also in the car but survived after workman Gavin Walsh came to his rescue at the scene, which was near Tebay services in Cumbria.
In a statement to the inquest, Mr Walsh said he was a passenger in a transit van travelling to Scotland when he witnessed the crash.
He jumped out of the vehicle and used a jack to smash the rear windscreen of the Toyota and pulled the boy out of the burning vehicle.
Mr Walsh said: “We really did try, I can assure everyone we did our best. We only had minimal time.
“I saved a life that day and I hope never to witness anything like that again.”
He added that he has never stopped thinking about the boy, and said: “I hope we will meet again one day and I will give you a massive hug.”
At the time, the family were returning to Glasgow from a trip to Legoland in Windsor, Berkshire.
The inquest heard that Wood, who was travelling at a speed of at least 65mph, would have been charged with manslaughter had he survived.
Recording conclusions of unlawful killing, Cumbria assistant coroner Margaret Taylor said: “I found that Jaroslaw, Jade, Filip and Dominic died as a consequence of the unlawful acts of another driver.”
The inquest heard how Mr Woods, from Cambridgeshire, had served a distinguished 14-year career in the RAF and was a flight instructor for BAE Systems at the time of his death.
Jade McEnroe. Pic: Cumbria Constabulary
Dominic and Filip. Pic: Cumbria Constabulary
In Ms Taylor’s record of inquest, Mr Woods was said to have been experiencing “a number of stressors in his life” and had a “history of harmful use of alcohol”.
Following the crash, he was found to be nearly four times over the legal drink-drive limit and a two-thirds empty bottle of gin was found in his car.
On the day of his death, concerns had been raised over his behaviour at a work conference near Preston in Lancashire.
Mr Woods failed to return to his seat after lunch and was later spotted driving erratically and swerving across three northbound carriageway lanes on the M6.
After pulling onto the hard shoulder, he then proceeded to U-turn and drove southward on lane three.
Filip, Dominic and Jaroslaw Rossa. Pic: Cumbria Constabulary
Detective Sergeant Deborah Story, from Cumbria Police, told the inquest that Mr Woods would have been prosecuted on four counts of manslaughter had he lived.
She said hypothetical charges of murder were considered by detectives but not thought appropriate because of a lack of information that Mr Woods knew the family or anything that provided a link between them.
Ms McEnroe’s parents, Marie McEnroe and George McNellis, told the coroner they thought it was “murder”.
Read more from Sky News:
Luton Airport expansion approved
Prince Harry responds to charity row
Appeal launched to help earthquake victims
A statement from the mother of Filip and Dominic, and the ex-wife of Mr Rossa, Kamila, was read out at the inquest.
She said Mr Rossa, known as Jarek, was born in Poland where they became a couple and went on to have three boys.
He loved playing computer games and had “lots of friends”, she said, and worked at the Wagamama restaurant in Silverburn, Glasgow.
She said she was “devastated” over the deaths, adding: “Our lives will never be the same.
“I am heartbroken at the passing of my beloved angels Filip and Dominic.”
Marie McEnroe said her daughter, a spa therapist, had been in a relationship with Mr Rossa for about two-and-a-half years.
She said Jade had been a “brilliant mother” to her only child, was “really happy” with Mr Rossa and it was “lovely chaos” when all the boys were playing together.
Ms McEnroe added: “Life changed forever that day”.
Ms Taylor praised the “selfless acts of bravery” from those in the aftermath of the collision, including Mr Walsh, who she said went towards the burning car “without hesitation for his own safety”.
The coroner added: “Without his swift response, Jade’s child would also have perished.”
Addressing the bereaved family members, she said: “Your loss is unimaginable but you have conducted yourself with dignity and I thank you for that. I wish you strength for the future.”
Anyone feeling emotionally distressed or suicidal can call Samaritans for help on 116 123 or email jo@samaritans.org in the UK. In the US, call the Samaritans branch in your area or 1 (800) 273-TALK.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports12 months agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business3 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway