Qakbot Leader Indicted

Summary

The US Department of Justice has indicted Rustam Rafailevich Gallyamov, the alleged leader of the Qakbot botnet, for his involvement in a global ransomware scheme. Gallyamov is accused of developing and deploying the Qakbot malware, which infected over 700,000 computers and facilitated numerous ransomware attacks. The indictment comes after a multinational effort to disrupt the Qakbot botnet in 2023, during which over $24 million in cryptocurrency was seized from Gallyamov.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

So, the DOJ has just announced charges against Rustam Rafailevich Gallyamov, a 48-year-old from Moscow, for allegedly masterminding the Qakbot malware operation. And honestly, it’s about time someone faced the music for this. I mean, Qakbot’s been a thorn in everyone’s side for years. This indictment is a pretty big win, especially considering how international cybercrime can be.

Qakbot: More Than Just a Banking Trojan

Qakbot, which some of you might know as Qbot or Pinkslipbot, started out as a banking trojan back in ’08. It was all about stealing financial info. But, boy, did it evolve! Over time, it became a full-blown malware delivery system. They say it infected over 700,000 computers worldwide! That’s like, having a digital army at your command. A compromised machine is like a door left unlocked for ransomware gangs.

The Ransomware Connection

How did Qakbot fit into the whole ransomware picture? Well, it was like the gateway drug. Once Qakbot infected a machine, it could then deliver more malware. Gallyamov would then rent out this access to various ransomware gangs, who would, of course, encrypt everything in sight. Conti, REvil, Black Basta… you name it, they probably used Qakbot at some point. And get this, Gallyamov apparently got a cut of the ransom. Can you imagine?

The estimated financial damage? Hundreds of millions. A report said that losses totalled over $58 million in just 18 months. That’s a scary number, and it underlines the severity of the issue.

Taking Down Qakbot (Almost)

Then, in 2023, the FBI, working with international law enforcement, managed to disrupt the Qakbot botnet. They hacked into the infrastructure, seized servers, and even tried to delete the malware from infected machines. They also seized over $8.6 million in cryptocurrency from Gallyamov, including Bitcoin and USDT. But, wouldn’t you know it, he didn’t stop there. They say he shifted to spam bomb attacks to try and get back into corporate networks. The DOJ even filed a forfeiture complaint against another $24 million in cryptocurrency seized from Gallyamov. And, recently, they grabbed more than 30 bitcoin and $700,000 in USDT, which is worth over $4 million. Talk about a digital hoard.

What’s Next?

Gallyamov’s facing charges of conspiracy to commit computer fraud and abuse, and wire fraud. The DOJ is really sending a message here: they’re not going to let cybercriminals hide, no matter where they are. This case just shows how complex and relentless the fight against ransomware is. It’s a constantly evolving threat, and we need international cooperation, strong cybersecurity, and awareness to fight back. Plus it highlights the need for ongoing public awareness campaigns to fight these attacks. After all, you can’t defend against what you don’t know is coming, right? One thing is for certain, this won’t be the last you hear of this kind of thing, it’s a constant battle of cat and mouse.