The US government has indicted Russian national Rustam Rafailevich Gallyamov, who is allegedly behind the infamous Qakbot botnet — a malicious network that infected over 700,000 computers worldwide and served as a gateway for dozens of ransomware attacks.
According to court documents, Gallyamov began developing Qakbot (also known as Qbot or Pinkslipbot) in 2008. Along the way, he created a wide network of infected systems with the help of a team of programmers, using the malware as a multi-tool – from a banking trojan to a dropper, backdoor and keylogger.
See also: New HTTPBot Botnet Targets Windows Machines
Since 2019, Qakbot has been a key infection vector for some of the most aggressive ransomware gangs, including Conti, REvil, Black Basta, Doppelpaymer, and others. Gallyamov reportedly took a cut of the ransom (for the initial access Qakbot provided), based on agreements with the attack groups.
Qakbot's network decimated businesses, healthcare providers, and government agencies worldwide, causing in financial losses hundreds of millions of dollars. In just 18 months, losses exceeded $58 million.
In 2023, the Qakbot botnet was dismantled by the FBIafter security experts breached parts of its infrastructure and took control of a computer used by a malware administrator.
See also: What are DDoS botnets and how to avoid them
Despite the botnet's collapse, Gallyamov reportedly continued his activities – according to authorities, he even carried out "spam bomb" attacks against victims in the US. These attacks continued until January 2025.
In the case, the U.S. Department of Justice today filed a lawsuit to seize more than $24 million worth of digital assets. In addition, last month, the FBI seized an additional 30 bitcoins and USDT tokens worth more than $4 million.
These actions were taken as part of the international operation “Operation Endgame”, which led to the dismantling of more than 100 servers that supported large botnets and loaders such as Trickbot, IcedID, Pikabot and Bumblebee.
See also: New XorDDoS malware allows creation of DDoS botnets
The devastation caused by Gallyamov while operating the Qakbot botnet highlights the need for protective measures (by users and businesses):
- To protect against this threat, it is important to software and operating system your device's. Botnet attacks often exploit known vulnerabilities.
- It is also essential to use a reliable security program that provides protection against malware and botnets. This should include performing regular scans to detect and remove any attacks.
- Using strong passwords and changing them regularly is another way to protect yourself from Botnets. Botnet attacks often try to guess passwords, so using strong passwords and changing them regularly can help protect your accounts.
- Finally, information security training can be particularly useful. Understanding how botnet attacks work can help you identify and avoid attacks.
Source: www.bleepingcomputer.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
