{
  "id": "case-operation-duck-hunt-qakbot",
  "slug": "operation-duck-hunt-qakbot-takedown",
  "title": "Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)",
  "summary": "Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.",
  "case_number": "8:23-mj-00458",
  "court": "U.S. District Court for the Central District of California",
  "district": "C.D. Cal.",
  "country": "United States",
  "opened_at": "2023-08-29",
  "status": "convicted",
  "victim_sector": "Financial Services & Enterprise IT",
  "victim_country": "United States",
  "loss_amount_usd": 128000000,
  "loss_amount_note": "Facilitated ransomware extortion resulting in an estimated $128 million in illicit payments from 2021 to 2023.",
  "first_seen_at": "2008-01-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "wizard-spider",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1566.001",
      "evidence_excerpt": "QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files.",
      "evidence_locator": "Application for Search Warrant \u00b6 18, Page 7",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Affidavit in Support of Seizure Warrant: Operation Duck Hunt",
      "source_url": "https://www.justice.gov",
      "technique_name": "Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1055",
      "evidence_excerpt": "The core loader injected malicious shellcode into legitimate processes such as explorer.exe and wermgr.exe to evade host-based anti-virus detection.",
      "evidence_locator": "Application for Search Warrant \u00b6 29, Page 14",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Affidavit in Support of Seizure Warrant: Operation Duck Hunt",
      "source_url": "https://www.justice.gov",
      "technique_name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "advisory",
      "event_date": "2020-10-28",
      "description": "CISA and FBI identify QakBot as primary initial access broker for Conti and ProLock ransomware cartels."
    },
    {
      "event_type": "court_order",
      "event_date": "2023-08-25",
      "description": "Federal magistrate judge in Santa Ana, California authorizes remediation and seizure order."
    },
    {
      "event_type": "takedown",
      "event_date": "2023-08-29",
      "description": "Operation Duck Hunt seizes 52 Tier-1 and Tier-2 command servers and detaches 700,000 infected hosts."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Adversary gained initial access via Spearphishing Attachment: QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files.",
    "blast_radius": "Resulted in $128,000,000 in documented financial liabilities. Facilitated ransomware extortion resulting in an estimated $128 million in illicit payments from 2021 to 2023.",
    "kill_chain": [
      {
        "phase": "Phase 1: Initial Access",
        "title": "Initial Perimeter Infiltration",
        "description": "QakBot was primarily distributed through malicious email attachments and hijacked email reply threads containing poisoned Microsoft OneNote, zip, and PDF files.",
        "technical_artifacts": [
          "T1566.001",
          "Spearphishing Attachment"
        ],
        "mitre_technique_id": "T1566.001"
      },
      {
        "phase": "Phase 2: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "The core loader injected malicious shellcode into legitimate processes such as explorer.exe and wermgr.exe to evade host-based anti-virus detection.",
        "technical_artifacts": [
          "T1055",
          "Process Injection"
        ],
        "mitre_technique_id": "T1055"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Services & Enterprise IT infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}