QakBot spent fifteen years turning a single opened email into a ransomware incident, and its 2023 takedown did not end the people behind it. This guide profiles QakBot (also called QBot, Pinkslipbot and QuackBot) for defenders: where it came from, who distributed it, how the FBI-led disruption in August 2023 worked, how its operators carried on with help desk impersonation and spam bombing, and which behaviours still show up in Windows telemetry. It is written for SOC analysts, detection engineers and incident responders who need to recognise a QakBot-style intrusion early, before hands-on-keyboard ransomware operators arrive. For the general loader pattern, see the Malware Loaders and Droppers Guide; this page covers the QakBot-specific history and detection detail.
Key takeaways
- A banking trojan that became a ransomware on-ramp. MITRE ATT&CK describes QakBot (S0650) as a modular banking trojan active since at least 2007 that evolved into a delivery agent for ransomware, and the US Department of Justice (DOJ) links it to Conti, ProLock, Egregor, REvil, MegaCortex, Black Basta and Cactus.
- The 2023 takedown removed the bot, not the follow-on access. In August 2023 the FBI redirected botnet traffic and pushed an uninstaller to more than 700,000 infected computers, but DOJ states it did not remove other malware already present.
- The operators adapted rather than stopped. A May 2025 indictment alleges the QakBot leader moved to spam bomb and fake help desk attacks, with activity against US victims as recently as January 2025.
- Behaviour beats indicators. ATT&CK lists 71 techniques for QakBot; the durable detections are script and LNK execution from user folders, signed binary proxy execution (rundll32, regsvr32, msiexec), process injection, scheduled tasks and domain trust discovery.
- Treat any QakBot alert as a pre-ransomware event. Isolate, collect evidence, reset exposed credentials and browser sessions, and hunt for remote management tools and Cobalt Strike rather than simply cleaning the one host.
Who they are (names and aliases)
QakBot is malware, not a single actor. It was developed and maintained by a core group and distributed by separate affiliates and initial access brokers who sold or used the access it produced. That split matters for defenders: a takedown of the botnet hits the developers and distributors, while the ransomware crews that bought access simply look for another loader.
| Name or entity | Type | What the sources say |
|---|---|---|
| QakBot, QBot, Pinkslipbot, QuackBot | Malware family (ATT&CK S0650) | Modular Windows banking trojan, active since at least 2007, later a ransomware delivery agent (MITRE ATT&CK). |
| Rustam Rafailevich Gallyamov | Alleged leader | Indicted in May 2025; DOJ alleges he developed, deployed and controlled QakBot from 2008 and sold access to ransomware co-conspirators for a share of ransoms. |
| TA577 | Initial access broker (G1037) | Distributed QakBot and later Pikabot, and was among the first groups seen distributing Latrodectus in 2023 (ATT&CK). |
| TA551 (GOLD CABIN, Shathak) | Financially motivated group (G0127) | Email-based malware distribution, listed by ATT&CK as a QakBot user. |
| Storm-1811 | Financially motivated entity (G1046) | Linked to Black Basta; Microsoft observed it delivering QakBot after email flooding and Quick Assist help desk scams in 2024. |
Treat names as tracking labels. Vendor names for the same distributor often differ, and ATT&CK lists only the groups with public reporting it has mapped.
Targeting and motivation
QakBot is financially motivated and opportunistic at the infection stage, then selective at the monetisation stage. Mass email campaigns infected whoever opened the attachment or link; the operators then sorted victims and sold or used the more valuable corporate footholds. DOJ described the botnet as at times including hundreds of thousands of victim computers, and the August 2023 operation identified more than 700,000 infected computers worldwide, more than 200,000 of them in the United States.
- Who gets hit: any organisation with Windows endpoints and email. Corporate domain-joined machines were the prize, because domain trust discovery (T1482) and network share discovery (T1135) tell the operator how far the access reaches.
- How it pays: DOJ alleges co-conspirators deployed ransomware and paid the leader a share of the ransom. The 2023 operation seized about 8.6 million US dollars in cryptocurrency, and the 2025 forfeiture complaint covers proceeds worth over 24 million US dollars.
- Why it matters to small organisations: the same mass campaigns hit small firms, and the access is sold on regardless of victim size. See the Initial Access Brokers Guide.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 maps 71 techniques to QakBot. The table groups the ones most useful for detection planning. It is a behavioural summary for defenders, not a reproduction of the malware's internals.
| Stage | ATT&CK techniques | What defenders see |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1204.002 Malicious File | Reply-chain or thread-hijack emails, archives, HTML attachments and container files. |
| Delivery evasion | T1027.006 HTML Smuggling, T1553.005 Mark-of-the-Web Bypass, T1036.008 Masquerade File Type | Files assembled in the browser, or delivered inside containers so downloaded content loses its internet zone marking. |
| Execution | T1059.005 Visual Basic, T1059.007 JavaScript, T1059.001 PowerShell, T1218.011 Rundll32, T1218.010 Regsvr32, T1218.007 Msiexec | Script hosts or signed Windows binaries loading a DLL from a user-writable folder. |
| Persistence | T1053.005 Scheduled Task, T1547.001 Registry Run Keys / Startup Folder, T1543.003 Windows Service | New tasks or Run keys pointing at random file names in AppData or ProgramData. |
| Defence impairment and stealth | T1055 Process Injection, T1055.012 Process Hollowing, T1497.001 System Checks, T1685 Disable or Modify Tools | Code running inside legitimate processes, sandbox checks, and attempts to alter security tooling. |
| Discovery | T1482 Domain Trust Discovery, T1069.001 Local Groups, T1135 Network Share Discovery, T1018 Remote System Discovery, T1518.001 Security Software Discovery | Bursts of built-in reconnaissance commands shortly after first execution. |
| Credential access and collection | T1555.003 Credentials from Web Browsers, T1539 Steal Web Session Cookie, T1185 Browser Session Hijacking, T1114.001 Local Email Collection, T1056.001 Keylogging | Access to browser credential stores and Outlook data, later reused for further phishing. |
| Command and control and spread | T1071.001 Web Protocols, T1090.002 External Proxy, T1573.001 Symmetric Cryptography, T1210 Exploitation of Remote Services, T1091 Replication Through Removable Media | Encrypted HTTPS beacons to rotating IP addresses, some of them other infected hosts acting as proxies. |
In ATT&CK v20, tampering with security tools sits under the Defense Impairment tactic (TA0112) as T1685, so older vendor reports that use earlier technique numbers need re-mapping before you compare coverage.
How they abuse identities and credentials
QakBot's value to ransomware crews was identity, not the bot itself. The credential techniques in ATT&CK show why a single infected laptop turns into a domain problem.
- Browser credentials and sessions: saved passwords (T1555.003) and session cookies (T1539) let the operator reuse SaaS and VPN sessions without a password prompt, which can bypass MFA that only fires at sign-in. See the Infostealer Logs and Session Token Abuse Guide.
- Email as a weapon: local email collection (T1114.001) fed reply-chain phishing, where the next victim receives a real thread from a real colleague with a malicious attachment added.
- Brute force and lateral movement: ATT&CK lists T1110 Brute Force and T1210 Exploitation of Remote Services. Weak shared local administrator passwords make this far easier; Windows LAPS removes that shortcut.
- Help desk impersonation: Storm-1811 used email flooding, then calls or Teams messages from tenants named "Help Desk" or "IT Support", to persuade users to grant remote control through Quick Assist (Microsoft, May 2024). This is an identity verification failure as much as a malware one. See the Email Bombing and Help Desk Impersonation over Teams Guide.
- Machine and service accounts: once on a server, operators look for service accounts with broad rights and stored credentials in scripts or scheduled tasks. Inventory and rotate them as part of recovery; the Service Account Security Guide covers the controls.
Notable incidents
| Date | Event | Source and key facts |
|---|---|---|
| 2007 to 2008 | Origins | ATT&CK dates QakBot to at least 2007; DOJ alleges the leader controlled it from 2008. |
| 2019 onwards | Ransomware access business | DOJ alleges QakBot was used from 2019 to build a botnet and sell access; ransomware named includes ProLock, DoppelPaymer, Egregor, REvil, Conti and Name Locker. |
| 29 August 2023 | FBI-led disruption with France, Germany, the Netherlands, the UK, Romania and Latvia, with Eurojust and Europol | FBI redirected botnet traffic to servers it controlled, which sent infected computers a law enforcement uninstaller. More than 700,000 infections identified, about 8.6 million US dollars in cryptocurrency seized. Shadowserver, Microsoft's Digital Crimes Unit and CISA helped with notification. |
| 2023 | Successor loaders | ATT&CK campaign C0037 records Pikabot distribution after the QakBot takedown with technical overlaps suggesting a possible connection, linked to Black Basta deployment. |
| April to May 2024 | Storm-1811 help desk scams | Microsoft observed email flooding, vishing and Quick Assist sessions leading to QakBot, Cobalt Strike, remote management tools and Black Basta. |
| April to May 2025 | Further seizure and indictment | FBI seized over 30 bitcoin and over 700,000 US dollars in stablecoins on 25 April 2025; the leader was indicted on 22 May 2025, with Black Basta and Cactus named. Operation Endgame listed the indictment among its May 2025 actions. |
For the Black Basta side of these intrusions, see the Black Basta Threat Actor Profile.
Detection and defence
Build detections on the stages QakBot cannot easily change: a user opening something, a script host or signed binary loading code from a user folder, rapid discovery, and persistence. Indicator feeds age within days.
Behaviour-level detection ideas
- Script and shortcut execution from downloads: wscript.exe, cscript.exe or mshta.exe started by an email client, browser or archive tool, with an outbound connection soon after (Sysmon Event ID 1 and 3, or EDR process and network events).
- Proxy execution: rundll32.exe or regsvr32.exe loading a DLL from AppData, Temp or ProgramData, especially with an unusual file extension.
- Discovery burst: several of whoami, ipconfig, net, nltest and arp run within minutes by a child of a non-interactive parent. Domain trust queries from a workstation are rare and high-value.
- Persistence: scheduled task creation (Security Event ID 4698) or new Run keys (Sysmon Event ID 13) pointing to user-writable paths.
- Help desk pattern: a sudden spike of subscription emails to one user, followed by an external Teams chat or a Quick Assist session.
- Beaconing: regular HTTPS connections from a non-browser process to bare IP addresses. See the Beaconing and C2 Detection Guide.
Mitigations mapped to frameworks
| Control | Why it helps against QakBot | Framework reference |
|---|---|---|
| Block macros from the internet, risky attachment types and container files at the mail gateway | Removes the most common first stage | NIST SP 800-53 SI-3, SI-8; CIS Control 9 |
| Application control and attack surface reduction rules (obfuscated scripts, PsExec and WMI process creation, executables not meeting prevalence) | Stops script and proxy execution chains; Microsoft recommends these rules against Storm-1811 | NIST SP 800-53 CM-7; CIS Control 2 |
| Block or remove Quick Assist and unused remote management tools; allow sessions only when the user called IT | Closes the 2024 help desk route | NIST SP 800-53 CM-7, AC-17 |
| Phishing-resistant MFA through Conditional Access authentication strength | Limits reuse of stolen passwords | NIST SP 800-53 IA-2 |
| EDR with tamper protection and network protection, central logging | Detects injection and discovery, resists tool tampering | NIST SP 800-53 SI-4; NIST CSF 2.0 DE.CM-01, DE.CM-09 |
| Restrict client-to-client SMB and use unique local administrator passwords | Slows lateral movement | NIST SP 800-53 SC-7, AC-6 |
Response steps when QakBot is found
- Isolate the host through EDR rather than powering it off, and preserve memory if the tooling allows.
- Scope: search for the same file names, scheduled tasks and C2 addresses across the estate, and check who received the original email thread.
- Hunt for follow-on tools: Cobalt Strike, ScreenConnect, NetSupport Manager and SystemBC were all observed by Microsoft in 2024 chains.
- Reset the user's passwords, revoke refresh tokens and sessions, and review mailbox rules for auto-forwarding.
- Reimage rather than clean, then monitor the user and host for 30 days.
- Report to your national CERT or law enforcement channel (in the US, the FBI via IC3), and share indicators with sector peers. See the Malware Outbreak Playbook.
Metrics that show it is working
- Median time from first script or proxy execution alert to host isolation (target: under 30 minutes).
- Percentage of endpoints with ASR rules in block mode and tamper protection on.
- Number of attachment and container types blocked at the gateway, reviewed quarterly.
- Count of endpoints with Quick Assist or unapproved remote tools present.
- Detection coverage: share of the eight stages in the technique table with at least one tested rule.
Practitioner checklist
- Map your detections against the QakBot technique set in ATT&CK S0650 and close gaps in execution, persistence and discovery first.
- Block internet macros, HTML and container attachments, and route remaining archives through a sandbox.
- Enable ASR rules for obfuscated scripts and PsExec/WMI process creation in audit, review for two weeks, then block.
- Remove Quick Assist where another remote support tool is standard, and publish how real IT staff contact users.
- Restrict external Teams access to allowed domains and train users to check the External label.
- Alert on domain trust discovery from workstations and on scheduled tasks pointing at user-writable folders.
- Treat any confirmed infection as pre-ransomware: credential and session reset, follow-on tool hunt, reimage.
- Subscribe to national CERT and Shadowserver notifications so takedown victim lists reach you.
Standards and references
- MITRE ATT&CK: QakBot (S0650)
- US Department of Justice: Qakbot Malware Disrupted in International Cyber Takedown
- US Department of Justice: Leader of Qakbot Malware Conspiracy Indicted for Involvement in Global Ransomware Scheme
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
- MITRE ATT&CK: Storm-1811 (G1046)
- MITRE ATT&CK: Water Curupira Pikabot Distribution (C0037)
- Operation Endgame: News
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · Emotet Malware Guide · Black Basta Threat Actor Profile · Cybercrime Law Enforcement Takedowns Guide