On August 29, 2023, the FBI announced Operation Duck Hunt: the dismantling of QakBot, a malware botnet that had infected over 700,000 machines globally and been used to distribute ransomware including Conti, ProLock, Egregor, REvil, BlackBasta, and others. The operation seized $8.6 million in cryptocurrency and, using a technique that was becoming a law enforcement signature, used QakBot's own update mechanism to push an uninstaller to infected machines. The FBI reported that 700,000 machines had the uninstaller pushed to them.

QakBot (also known as Qbot, Pinkslipbot) had been active since 2008 - making it one of the oldest continuously operational malware families in the threat landscape. It had started as a banking trojan, evolved through multiple major code rewrites, and by 2020 had become what Emotet was: a malware loader that sold access to ransomware operators. The shutdown of Emotet in January 2021 created an opportunity that QakBot's operators had exploited aggressively. When Emotet went dark, ransomware affiliates looking for initial access distribution partners turned to QakBot. The botnet's monthly active victim count grew substantially in 2021-2022 as it absorbed business from the disrupted Emotet operation.

What QakBot Was

QakBot's technical architecture had been rebuilt multiple times over its 15-year operational history. The version active in 2023 was substantially different from the 2008 banking trojan. It used a multi-tier C2 architecture: infected machines communicated with a tier of compromised residential routers (the "tier 1" infrastructure, devices the operators did not own but had hijacked as proxies), which forwarded traffic to the actual QakBot backend infrastructure. This made attribution and takedown more complex - law enforcement taking down a residential router being used as a proxy was legally and operationally different from seizing attacker-controlled servers.

The primary distribution method in the 2022-2023 period was malicious email campaigns using OneNote files. Microsoft had disabled automatic macro execution in Office documents in 2022, which had significantly degraded the effectiveness of macro-laden Word/Excel document delivery that malware families including QakBot and Emotet had relied on. The shift to OneNote files exploited a feature that allowed embedded executables in OneNote format - a bypass that Microsoft patched in 2023.

Once installed, QakBot would inject itself into legitimate processes (typically Windows processes like wermgr.exe or AtBroker.exe) to evade process-based detection, establish persistence through scheduled tasks and registry keys, and await commands from C2. It supported downloading and executing additional payloads: Cobalt Strike beacons for ransomware pre-positioning were the most common, but any executable could be dropped.

[TECHNICAL NOTE]
QakBot's process injection technique evolved over its operational history. The 2022-2023 variant used a technique called "thread hijacking injection": it would suspend a thread in a target process, write shellcode to the process memory, modify the instruction pointer to redirect execution to the shellcode, then resume the thread. The shellcode would load the QakBot DLL. This technique evaded endpoint detection tools that monitored for CreateRemoteThread API calls (a common injection detection method) because it used SuspendThread and SetThreadContext instead.

Operation Duck Hunt: The Technical Execution

The FBI's court filings for Operation Duck Hunt provided unusually detailed disclosure of the law enforcement methodology, which has become a model for similar operations. The key steps were: obtaining access to QakBot's administrative backend, redirecting QakBot-infected machines' traffic from the real C2 to an FBI-controlled server, and then distributing a custom uninstaller through the FBI's substituted C2.

The FBI obtained access to QakBot's C2 infrastructure through technical means not fully disclosed, but evidenced in the court documents by the agency's ability to read the encrypted communications between the QakBot backend and its tier-1 proxy nodes. With this access, they could see the full botnet: the list of infected machines, the tier-1 infrastructure acting as proxies, and the communication protocol.

The uninstaller was a custom-built executable that the FBI obtained authorization (through a search warrant) to distribute. It performed the following operations: graceful shutdown of the QakBot process, deletion of QakBot's components from the filesystem, deletion of QakBot's registry persistence entries, and notification to the FBI's server that the uninstallation had completed. The FBI reported that machines in the botnet received the update and executed the uninstaller within approximately 14 days of the operation's start.

[WARNING]
The legal authority for Operation Duck Hunt's remote access component was a single search warrant from the Central District of California. The warrant authorized accessing the QakBot-infected machines to copy and delete QakBot software. Critics noted that this warrant authorized the FBI to modify files on 700,000 computers in countries around the world - including computers of US persons - without individual warrants for each device. The Electronic Frontier Foundation raised concerns that the Rule 41 authority used was not clearly applicable to non-US systems and that the operation lacked notification procedures to allow affected device owners to object. The operation's defenders noted that the modification was purely remedial (removing known malware) and that notifying 700,000 device owners before the operation would have tipped off the QakBot operators.

The Cryptocurrency Seizure

The $8.6 million in cryptocurrency seized represented QakBot's operational cryptocurrency holdings - funds held in wallets the operators used for infrastructure payments and, presumably, some fraction of their revenue. The amount was small relative to the estimated scale of QakBot's operations (the ransomware campaigns it facilitated had collectively generated hundreds of millions of dollars) but represented what law enforcement could trace and seize.

The cryptocurrency tracing followed standard blockchain analytics methodology: identify known QakBot-associated wallet addresses (from infrastructure payments observed during the investigation), trace fund movements through on-chain analysis, identify exchange deposits and other conversion points, and work with exchanges under legal process to freeze and seize. The $8.6 million was explicitly described as proceeds traceable to QakBot's operations rather than a comprehensive accounting of the group's total earnings.

The QakBot Resurrection

Like Emotet before it, QakBot returned after its takedown. In December 2023, approximately four months after Operation Duck Hunt, security researchers at Zscaler and Secureworks observed new QakBot samples being distributed through phishing campaigns. The rebuilt QakBot used different C2 infrastructure, had code updates suggesting active development, and was using new distribution methods. By early 2024, QakBot campaigns were active again, though at lower volume than pre-takedown levels.

The pattern confirmed what the Emotet resurrection had suggested: infrastructure takedowns without core operator arrests produce measured disruption rather than permanent elimination. QakBot's operators had not been identified or charged. They retained their technical capabilities and, after a period of rebuilding infrastructure and updating the malware, resumed operations.

The US Department of Justice noted in Operation Duck Hunt announcements that QakBot-associated individuals had not been charged, explicitly distinguishing the operation from cases where arrests accompanied infrastructure seizures. Subsequent reporting suggested the QakBot operators were believed to be in Russia or Eastern Europe, outside effective extradition reach - the same limitation that constrained operations against Emotet, Gameover Zeus, and most other major botnet operators.

The Loader Ecosystem: QakBot's Position

QakBot's temporary takedown illuminated the malware loader ecosystem's structure. Ransomware operators depend on loaders for initial access distribution at scale; when a major loader is disrupted, they shift to alternatives. The period between QakBot's August 2023 takedown and its December 2023 return saw increased activity from competing loaders: IcedID (Bokbot), Pikabot, and DarkGate all showed increased distribution volume as affiliates sought alternatives.

This competitive dynamic is one reason why loader takedowns have limited industry impact: the ransomware ecosystem can absorb the loss of a single loader by shifting to others. The same affiliates, the same ransomware infrastructure, and the same target selection methodology continue operating through whichever loader is currently available. Permanently disrupting the ransomware economy would require simultaneously taking down all major loaders and the ransomware backends they serve - an operation of a scale and coordination not yet achieved.

[IOC]
QakBot detection indicators (2022-2023 variant): Initial delivery via OneNote files with embedded executable or malicious link. Process: QakBot injects into wermgr.exe, AtBroker.exe, or other Windows processes (verify parent-child process relationships). Registry persistence: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or scheduled task with random name. Network: Outbound connections to compromised residential routers (residential ISP IPs, port 443 or 65400). File: QakBot DLL typically in %APPDATA% or %LOCALAPPDATA% subdirectory. Post-infection: Cobalt Strike beacon delivered within hours; look for wermgr.exe or similar making network connections. Sandbox indicators: Anti-analysis checks (registry userdata, sleep-based evasion, encrypted configuration with hardcoded decryption key). YARA rules and config extractors maintained at abuse.ch QakBot tracker.