FBI Dismantled QakBot Botnet Worldwide
In this post
Picture a machine in your home. It hums quietly in the corner, doing the jobs you ask of it all day. But at night, while you sleep, it has been taking secret orders from strangers on the other side of the planet — orders to steal, to spy, and to hold the door open for worse criminals. You never noticed. Almost nobody did. Then, on one late-August night in 2023, a new order travelled down those same secret wires. It was not from the criminals. It came from the FBI, and it gave the hidden program one final instruction: delete yourself. By the time the sun came up, more than 700,000 infected computers around the world had quietly cleaned themselves — and most of their owners never even knew anything had happened.
What QakBot Is and What It Does
QakBot, also called Qbot, began around 2007 as a banking trojan. A trojan is a type of harmful program — malware — that pretends to be harmless while doing damage in secret. QakBot’s first job was stealing online banking logins. When an infected person typed in the username and password for their bank account, QakBot could record those details and send them to the criminals running it, giving them a path into other people’s money.
Over the years, though, QakBot grew into something much bigger and more dangerous than a simple password thief. It became a delivery machine. Criminal gangs discovered that a QakBot infection inside a company was the perfect doorway: once QakBot was quietly sitting on a company’s computers, bigger and nastier criminals could walk through that door and launch ransomware attacks — the kind that lock up every file a business owns and demand a huge payment to unlock them. QakBot’s operators even rented out the access they had gained. Other criminals paid them money just to be let inside networks that QakBot had already infected.
That is what makes QakBot different from a lone thief. A thief steals from one house. QakBot built secret entrances into hundreds of thousands of houses, and then sold tours of those entrances to the most dangerous gangs in the business. A computer infected with QakBot might not be attacked today or tomorrow. It was worse than that: it was waiting, patiently, on a list of homes the criminals could enter whenever they pleased.
How QakBot Spreads and Reaches Ordinary People
QakBot did not smash its way into computers. It arrived politely, by email. Its main road into a machine was the phishing email — a fake message designed to look ordinary and trustworthy, carrying an infected attachment or a dangerous link. A worker in an office might open what looked like a normal document from the daily flood of mail. A person at home might click a link in a message that seemed to come from a company they knew. One careless moment was enough. The attachment or link quietly installed QakBot, and from that instant the computer belonged to two owners: the person sitting in front of it, and the strangers who could now command it from far away.
This matters because phishing emails are not rare traps set for careless people. They are an everyday flood, and they only need to fool somebody once. The secretary who opens one wrong file on a busy morning is not foolish — she is busy, and the criminals design their messages for exactly that moment. That single click in one ordinary office could become the doorway through which a ransomware gang later entered the whole company. I find that the scariest part of the whole story: a global criminal empire really can begin with one tired person, one normal-looking email, and one click.
The Damage QakBot Caused
The damage from QakBot is hard to measure in a simple count of stolen passwords, because so much of its harm came from what it made possible. Every infected computer was a loaded risk. It could quietly give up banking details. It could be rented out. And when ransomware gangs used QakBot’s doorways, companies could find their systems locked, their work frozen, and ransom demands waiting on their screens. The owners of the infected machines often had no idea their computers were part of the problem, which meant the infection could sit in place for a long time, doing quiet work for criminals.
By the time police moved against it, QakBot’s network stretched across the entire planet. According to the US Department of Justice, the malware was eventually uninstalled from more than 700,000 infected computers worldwide — a number that gives some idea of just how many machines had been silently recruited. Investigators also seized about $8.6 million in cryptocurrency from the operation, a glimpse of the money flowing through this hidden business.
Operation Duck Hunt: The Night the Botnet Deleted Itself
In late August 2023, the FBI led an international operation with a memorable name: Operation Duck Hunt. Police forces from France, Germany, the Netherlands, the United Kingdom, Romania and Latvia took part. Together, they seized control of QakBot’s command infrastructure — the central system the criminals used to send orders to all those infected computers.
Seizing the command system alone would have been a solid victory. But the investigators did something bolder. The FBI redirected the botnet’s own traffic to servers the bureau controlled. Then, through the botnet itself, they delivered an uninstaller — a small program built to remove QakBot — directly into the infected machines. The same network that had carried the criminals’ secret orders now carried the police’s final order: remove yourself. According to the Department of Justice, QakBot was uninstalled from more than 700,000 infected computers around the world.
Think about what that means for a moment. Hundreds of thousands of people woke up with cleaner computers than they had the night before, and they never knew. Nobody knocked on their doors. No officer visited their homes. The police simply reached through the criminals’ own wires, into machines scattered across continents, and switched the infection off. It was one of the most unusual police actions in internet history — not a chase, not a raid on a building, but the enemy’s own army ordered to stand down and disappear.
The work was not finished forever, of course. Security researchers warned that botnet operators often try to rebuild after a takedown, and smaller campaigns linked to QakBot were reported in later months. A victory over malware is rarely a full stop. It is more like winning a season: the other side regroups, changes shirts, and looks for a way back onto the field.
How to Protect Yourself From Malware Like QakBot
The good news hidden inside this story is that QakBot’s favourite road — the phishing email — is a road you can guard. A few steady habits make a real difference.
Slow down before opening email attachments. QakBot arrived mainly through infected attachments and links in fake messages. If an email arrives unexpectedly, urges you to hurry, or asks you to open a file you were not waiting for, treat it with suspicion. A message that creates panic is usually trying to stop you from thinking.
Keep your computer and programs updated. Updates are not just new features. They repair the weak spots that malware uses to get in and stay in. Turning on automatic updates means those repairs arrive without you needing to remember them.
Use antivirus protection and keep it active. Good security software watches for known malware and suspicious behaviour. It is not a magic wall, but it is a guard on duty — and a guard only helps while he is awake and on the job.
Be careful with links, even from familiar names. A message can appear to come from a company or a person you know and still be fake. If a link in an email matters, it is safer to visit the service through its official app or by typing the address yourself, rather than trusting the link that arrived in your inbox.
Remember that one click can open a company door. If you use a computer at work, your careful habits protect more than your own files. The QakBot story shows how a single inbox can become the entrance to an entire business.
Common questions
Was my computer one of the 700,000 that the FBI cleaned?
There is no simple way to know, and most owners never found out either way. The Department of Justice said QakBot was removed from more than 700,000 infected computers, but the owners were scattered worldwide and were mostly unaware they had ever been infected. The practical response is not to wonder about the past, but to keep your system updated and protected now.
Did the FBI read people’s private files during Operation Duck Hunt?
The announced goal of the operation was narrow: seize QakBot’s command infrastructure and use it to push out an uninstaller that removed the malware. Public statements from the Department of Justice described the action as removing QakBot from infected computers, not as a general search of people’s personal data.
Is QakBot completely gone now?
Not certainly. The takedown badly damaged the network, but researchers warned that botnet operators often try to rebuild, and smaller QakBot-linked campaigns were reported afterwards. This is exactly why the protective habits in this post still matter.
How did QakBot get into so many computers?
Mainly through phishing emails containing infected attachments or dangerous links. One person opening the wrong file could install it silently. Once inside a company, that infection could serve as a doorway for ransomware gangs and for rented criminal access.
Why did the criminals bother renting out access to infected computers?
Because access itself is valuable. A gang with ransomware does not want to waste time breaking into a company if somebody else has already done that work. QakBot’s operators sold or rented the entrances they had built, turning one infection into income again and again.
Sources
- Wikipedia — Qbot: https://en.wikipedia.org/wiki/Qbot
- US Department of Justice — Qakbot victim resources and Operation Duck Hunt press releases (August 2023): https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources
