The FBI, NCA and other European crime officials have removed a network of malicious software from thousands of infected computers, US officials have said.
The Qakbot software – a piece of code that lurked unseen in the majority of the computers it had secretly installed itself on – was used as part of online crimes, including ransomware attacks, for more than 15 years.
The criminal network behind it made around $58m (£45.8m) from victims, between October 2021 and April 2023, officials said.
Victims included an Illinois-based engineering firm, financial services organisations in Alabama and Kansas, a Maryland defence manufacturer and a southern California food distribution company, Los Angeles US attorney Martin Estrada said.
“Nearly every sector of the economy has been victimised by Qakbot,” Mr Estrada said.
Image: US Attorney Martin Estrada said Qakbot malware had infected more than 700,000 victim computers. Pic: AP
In an operation dubbed “Duck Hunt”, the FBI along with Europol and crime and justice officials in France, Germany, the Netherlands, Romania and Latvia, seized more than 50 Qakbot servers and identified more than 700,000 infected computers worldwide.
By doing this, criminals were effectively cut off from their source.
The FBI then used the seized Qakbot infrastructure to remotely dispatch updates that deleted the malware from thousands of infected computers.
In the UK, the National Crime Agency ensured the criminal network’s UK servers were taken offline on Saturday, at the same time as Qakbot’s other infrastructure elsewhere.
Advertisement
Will Lyne, Head of Cyber Intelligence at the NCA, said: “This investigation has taken out a prolific malware that caused significant damage to victims in the UK and around the world.
“Qakbot was a key enabler within the cyber crime ecosystem, facilitating ransomware attacks and other serious threats.”
Researchers said they believed the cybercriminals were in Russia or other former Soviet states, but Mr Estrada did not say exactly where.
What is Qakbot?
First appearing in 2008, Qakbot gives criminal hackers initial access to violated computers.
Usually delivered via phishing email infections, criminals could then install additional ransomware, steal sensitive information or gather intelligence on victims to enable financial fraud and crimes such as tech support and romance scams.
Image: FBI assistant director in charge, Don Alway. Pic: AP
Once infected, the computers became part of a botnet – a network of computers infected by malware and under the control of a single attacking party.
Qakbot affected one in 10 corporate networks and accounted for about 30% of global attacks, a pair of cybersecurity firms found.
The operation has been the biggest success for the FBI against cybercriminals, but experts warned that any setback to cybercrime would likely be temporary.
Chester Wisniewski, a cybersecurity expert at Sophos – a UK-based security software and hardware company – said that while there could be a temporary drop in ransomware attacks, the criminals are expected to either revive infrastructure elsewhere or move to other botnets.
“This will cause a lot of disruption to some gangs in the short term, but it will do nothing [to stop it] from being rebooted,” he said.
“Albeit it takes a long time to recruit 700,000 PCs.”
Britain’s most-wanted fugitive is still on the run – exactly 20 years after the fatal shooting of a young mother of three.
Kevin Parle is a suspect in the murder of Lucy Hargreaves, 22, who was shot dead at her home in Liverpool before the house was set on fire on 3 August 2005.
Since then, after many appeals for information, there has been no confirmed sighting, word or trace of him.
Two decades on, Ms Hargreaves’ family have had no justice. Two young men prosecuted for her murder had charges dropped when a judge ruled there was insufficient evidence against them.
In a statement marking the anniversary of her death, they said: “The way we lost Lucy is not something families can ever truly come to terms with – it is still incredibly difficult and painful to think about.
“Over the past 20 years, people will have talked with family and friends. A number of people were contacted by males using a phone that was stolen along with a vehicle used in Lucy’s murder.
“We appeal directly to them to please come forward. Now is the time.”
Image: Police prediction of how Kevin Parle has aged since 2005. Pic: Merseyside Police
Three men burst into Lucy’s home 20 years ago today, shot her dead as she slept on a sofa, and set alight the duvet she’d been sleeping under.
It’s believed the gang were looking for her boyfriend Gary Campbell, who was upstairs. He fled from a window with their two-year-old daughter and then tried in vain to save Ms Hargreaves.
Mr Campbell had allegedly been a passenger in a stolen car that had hit and killed a young boy 12 years earlier, supposedly the motive for the shooting. He denied he was in the car at the time.
Image: Ms Hargreaves with her three children
Howard Rubbery, head of the Serious Crime Review Unit at Merseyside Police said: “The family remain absolutely devastated by Lucy’s death.
“It’s important to note Lucy is an absolutely innocent victim. She’s not from a family of criminality. She wasn’t involved in criminality.
“The hunt for Kevin Parle is very much on, and we ask anybody with information, anybody who is close to Parle and knows where he is, to please come forward.
“There were three males responsible for this offence and we are looking for justice for Lucy’s family in relation to all three.
“I do believe that there are people out there who have yet to speak to the police, even though it’s 20 years on, who hold information that’s absolutely vital to our investigation.”
Police believe Parle, now in his 40s, fled to Spain where he hid among the vast expat community with criminal help.
Several years later, I tracked his movements to a holiday complex near Torrevieja, where staff convinced me he had stayed there for several weeks.
Image: Former detective Peter Bleksley says Parle is being protected
‘Huge value to organised crime’
Former Scotland Yard detective Peter Bleksley, who recently spent four years on a personal hunt for Parle, also visited the complex and said: “He was bold and he was brash and he had a girlfriend at one point.
“The police actually should have captured him there, but they were too late.”
He claimed he nearly caught up with Parle at a villa elsewhere in Spain, but spooked him into disappearing again.
Mr Bleksley hosted an award-winning podcast and wrote a book in which he chronicled his manhunt.
He said: “Kevin Parle has remained hidden because he is funded, protected, looked after and of huge value to global, serious and organised crime.”
Parle can’t be hard to spot – he’s well-built, 6ft 5in tall, red-haired with a face scar and, originally at least, has a Liverpool accent. Of course, he might be dead.
Mr Bleksley said: “I can think of many reasons why certain criminals would want to get rid of Kevin Parle because he could, in terms of evidence about the cases that he’s wanted for, should he flip and become a witness for the Crown, be highly damaging for a lot of very tasty criminals.”
Image: 16-year-old Liam Kelly was shot dead a year before Ms Hargreaves. Pic: Merseyside Police
Parle is also wanted in connection with the murder of 16-year-old Liam Kelly, who was shot dead over an alleged £200 debt in June 2004, a year before Lucy’s death. Parle was arrested and questioned, but then freed on bail.
There have been reports of the fugitive in Australia and Dubai, but nothing to corroborate any of them.
If he’s alive and if no one is prepared to shop him, what might lead to his capture?
“I think when he has a fallout with those who have guarded him, funded him, fed him, put a roof over his head and all of that, maybe even paid for his plastic surgery that could have altered his appearance,” Mr Bleksley said.
“When he finally has a fallout, when he’s no longer of use, then perhaps that will be the day that somebody goes, Peter, he’s here.”
Several demonstrators have been detained after rival groups faced off over a hotel accommodating asylum seekers in north London, with police breaking up brief clashes.
The Metropolitan Police has since imposed conditions on the protest and counter-protest outside the Thistle City Barbican Hotel in Islington.
The protest was organised by local residents under the banner “Thistle Barbican needs to go – locals say no”.
The group of several hundred people waved union flags and banners, and one man chanted: “Get these scum off our streets.”
Image: Anti-immigration protesters waved Union Jack flags. Pic: PA
A larger group staged a counter demonstration to voice support for asylum seekers, bearing a banner that read: “Refugees are welcome.”
People inside the hotel, believed to be migrants, watched on, with some waving and blowing kisses from the windows.
More on Migrant Crossings
Related Topics:
Image: People believed to be asylum seekers waved the hotel windows. Pic: PA
Image: Pro-immigration protesters gathered by the Thistle City Barbican Hotel. Pic: PA
A man wearing an England football shirt was detained by police after getting into an altercation with officers.
There have been nine arrests so far, seven of which were for breaching conditions police put on the protests under the Public Order Act.
Rival groups separated by police
Another protest was scheduled in Newcastle on Saturday, outside The New Bridge Hotel, as anti-migrant sentiment ripples through some communities around the country, also flaring up recently in Epping.
Please use Chrome browser for a more accessible video player
4:09
Last week: Protesters divided over migrant hotels
The counter-protest in London was organised by local branches of Stand Up To Racism, and supported by former Labour leader and Islington North MP Jeremy Corbyn.
Other community groups including Finsbury Park Mosque and Islington Labour Party were also involved.
Groups online that backed the original protest include “Patriots of Britain” and “Together for the Children”.
At one point, a large group of masked protesters dressed in black, calling themselves anti-fascists, appeared from a side street and marched towards the rival group outside the hotel.
The two groups briefly clashed before police rushed in to separate them.
Image: Pic: PA
Image: Supporters of local protest group ‘Thistle Barbican needs to go – locals say no’. Pic: PA
Why are asylum hotels used?
The government is legally required to provide accommodation and subsistence to destitute asylum seekers while their claims are being decided, most of whom are prohibited from working.
A jump in the use of hotels since 2020 has been attributed to the impacts of the COVID pandemic, a backlog in unresolved asylum cases, and an increase in the number of migrants crossing the Channel in small boats.
However, the number of asylum seekers living in hotels has fallen recently, from 38,079 at the end of 2024 to 32,345 at the end of March 2025, according to the Refugee Council.
How police tried to keep groups apart
The police imposed conditions on both groups in London to prevent “serious disorder” and minimise disruption to the community.
Those in the anti-asylum hotel protest were told to remain within King Charles Square, and to gather not before 1pm and wrap up by 4pm.
Those in the counter-protest were to required to stay in an area in Lever Street, and assemble only between 12pm and 4pm, but were still in eye and ear shot of the other group.
Chief Superintendent Clair Haynes, in charge of the policing operation, said: “We have been in discussions with the organisers of both protests in recent days, building on the ongoing engagement between local officers, community groups and partners.
“We understand that there are strongly held views on all sides.
“Our officers will police without fear or favour, ensuring those exercising their right to protest can do so safely, but intervening at the first sign of actions that cross the line into criminality.”
Meanwhile, the protest in Newcastle was promoted by online posts saying it was “for our children, for our future”.
The “stop the far right and fascists in Newcastle” counter-protest was organised by Stand Up To Racism at the nearby Laing Art Gallery.
A man has been remanded into custody charged with child cruelty offences after allegedly lacing sweets with sedatives.
Jon Ruben, 76, of Ruddington, Nottinghamshire, appeared at Leicester Magistrates’ Court on Saturday after youngsters fell ill at a summer camp in Stathern, Leicestershire.
He has been charged with three counts of wilfully assaulting, ill-treating, neglecting, abandoning or exposing children in a manner likely to cause them unnecessary suffering or injury to health.
The charges relate to three boys at the camp between 25-29 July.
Image: The scene in Stathern, Leicestershire. Pic: PA
Ruben spoke only to confirm his name, age and address.
Police received a report of children feeling unwell at a camp being held at Stathern Lodge, near Melton in Leicestershire, last Sunday.
Officers said paramedics attended the scene and eight boys – aged between eight and 11 – were taken to hospital as a precaution, as was an adult. They have since been discharged.
Police said the “owners and operators of Stathern Lodge are independent from those people who use or hire the lodge and are not connected to the incident”.
Leicestershire Police has referred itself to the Independent Office for Police Conduct, after officers initially reported the incident as having happened on Monday, only to later amend it to Sunday.
It is still unclear when officers responded and whether that is why the watchdog referral has been made.
Ruben will next appear at Leicester Crown Court on 29 August.