Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)
Key Facts
- Legal Status: CONVICTED in U.S. District Court for the Central District of California.
- Primary Target Sector: Financial Services & Enterprise IT.
- Documented Financial Loss: $128.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
Root Cause & Infiltration Vector
Adversary gained initial access via Spearphishing Attachment: QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files.
Operational Impact & Financial Blast Radius
Resulted in $128,000,000 in documented financial liabilities. Facilitated ransomware extortion resulting in an estimated $128 million in illicit payments from 2021 to 2023.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files.
The core loader injected malicious shellcode into legitimate processes such as explorer.exe and wermgr.exe to evade host-based anti-virus detection.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Services & Enterprise IT infrastructure.
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
CISA and FBI identify QakBot as primary initial access broker for Conti and ProLock ransomware cartels.
Federal magistrate judge in Santa Ana, California authorizes remediation and seizure order.
Operation Duck Hunt seizes 52 Tier-1 and Tier-2 command servers and detaches 700,000 infected hosts.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1566.001 | Spearphishing Attachment Initial Access | "QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files." | Application for Search Warrant ¶ 18, Page 7 | reviewed |
| T1055 | Process Injection Defense Evasion | "The core loader injected malicious shellcode into legitimate processes such as explorer.exe and wermgr.exe to evade host-based anti-virus detection." | Application for Search Warrant ¶ 29, Page 14 | reviewed |