VORANT. Threat Intelligence Sign in Get the full feed

FBI dismantles Qakbot botnet infrastructure

high threat financial-serviceshealthcaregovernment-national

The FBI led a multinational takedown of the Qakbot malware botnet, disinfecting over 700,000 infected computers worldwide.

On August 29, the FBI and DOJ announced a coordinated law enforcement operation across the U.S., France, Germany, the Netherlands, Romania, Latvia, and the United Kingdom to disrupt and dismantle the Qakbot malware and its botnet infrastructure. Active since 2008, Qakbot spread primarily via malicious spam email attachments and links, and once installed, it delivered additional payloads including ransomware while enrolling victim machines into a remotely controlled botnet. Victims spanned financial institutions, a critical infrastructure government contractor, and a medical device manufacturer, reflecting the broad and indiscriminate reach of the botnet's criminal supply chain.

The FBI gained lawful access to Qakbot's command-and-control infrastructure and identified over 700,000 infected devices globally, including more than 200,000 in the United States. To neutralize the botnet, the Bureau redirected Qakbot network traffic to servers under its control, which instructed infected machines to download an uninstaller designed to remove the malware and sever the devices from the botnet, preventing further malware deployment.

This operation is characterized as one of the largest U.S.-led disruptions of botnet infrastructure to date, targeting a malware family long used as a delivery mechanism for ransomware and financial fraud. The action highlights ongoing international law enforcement collaboration against cybercriminal infrastructure that has caused hundreds of millions of dollars in losses over the botnet's operational lifetime.

Mentioned in this report

Malware QakBot

Detection guidance

Office Application Spawning Script Interpreter or Shell (Phishing Attachment Execution)

ATT&CK T1566.001

Detects a Microsoft Office process spawning a script host, shell, or LOLBin child process, a common pattern following execution of a malicious email attachment such as those used by Qakbot for initial infection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Office Application Spawning Script Interpreter or Shell
id: c2f172fe-13da-5f23-9ae5-85f03e41a7c6
status: experimental
description: Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning
  script interpreters, command shells, or living-off-the-land binaries. This pattern
  is consistent with malicious document attachments delivered via spearphishing, such
  as those historically used to deliver Qakbot.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\winword.exe
    - \\excel.exe
    - \\powerpnt.exe
    - \\mspub.exe
    - \\wordpad.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\wscript.exe
    - \\cscript.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate macro-enabled business workflows that call scripts or command-line utilities
- Document automation tools or add-ins that invoke shell commands
level: medium
tags:
- attack.t1566.001
- attack.initial_access
author: Vorant

Suspicious LOLBin Loading DLL from User-Writable Path (Post-Attachment Payload Execution)

ATT&CK T1566

Detects rundll32.exe or regsvr32.exe loading a DLL from a user profile, temp, or downloads directory, a common technique for executing a dropped payload after a phishing attachment is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LOLBin Executing DLL From User-Writable Directory
id: 6f790681-2287-5e2b-a1bf-a5e0211fd998
status: experimental
description: Detects rundll32.exe or regsvr32.exe launching a DLL located in a user-writable
  directory such as AppData, Temp, or Downloads. This pattern is frequently observed
  when malware droppers delivered via phishing attachments execute their payload.
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \\rundll32.exe
    - \\regsvr32.exe
  selection_path:
    CommandLine|contains:
    - :\\Users\\
    - \\AppData\\
    - \\Temp\\
    - \\Downloads\\
  filter_common:
    CommandLine|contains:
    - \\Program Files\\
    - \\Windows\\System32\\
  condition: selection_image and selection_path and not filter_common
falsepositives:
- Legitimate software installers that register DLLs from user download locations
- IT deployment scripts executing rundll32 against files staged in AppData
level: medium
tags:
- attack.t1566
- attack.defense_evasion
author: Vorant

HTTP C2 Beaconing to Raw IP Address Over Non-Standard Port

ATT&CK T1071

Detects outbound application-layer connections directly to an IP address (no DNS resolution) over commonly abused non-standard HTTP ports, consistent with Qakbot-style bot check-in traffic to its command-and-control infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: HTTP-Like C2 Beacon to Raw IP on Non-Standard Port
id: 8b8ca2eb-e818-57fb-b877-8703466c3cc6
status: experimental
description: Detects network connections from a host process to a literal IP address
  destination over ports commonly used by botnet command-and-control channels but
  atypical for standard web browsing, which may indicate application layer C2 beaconing
  similar to that used by Qakbot-infected hosts.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
    - 443
    - 2222
    - 65400
    - 8080
    - 995
    Initiated: 'true'
  filter_browser:
    Image|endswith:
    - \\chrome.exe
    - \\firefox.exe
    - \\msedge.exe
    - \\iexplore.exe
  condition: selection and not filter_browser
falsepositives:
- Legitimate applications using non-standard ports for encrypted communication (e.g.
  VPN clients, remote management tools)
- Internal services communicating directly via IP rather than DNS name
level: low
tags:
- attack.t1071
- attack.command_and_control
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free