Cyber world hails downfall of Qakbot trojan

Hunting Qakbot

The Secureworks Counter Threat Unit (CTU), has been on the tail of Qakbot for some time, and earlier this year, the CTU team under vice-president Don Smith was able to track and observe activity transiting one of Qakbot’s command and control (C2) servers.

During this operation, the team also took steps to make sure the server did not pass any malicious traffic to backend infrastructure, effectively rendering it useless to Qakbot’s operators, who are tracked as Gold Lagoon in the Secureworks threat actor matrix.

The team saw 10,000 infected machines in 153 countries connecting to the server over a four-month period, at least 5,000 of which were connected to a domain, meaning they were owned and operated by a business or other organisation, not a private individual.

Because Qakbot used campaign IDs to track its operations, Smith’s team was able to track three distinct campaigns during the period, BB, Obama and Snow. The BB and Obama campaigns both targeted systems in North America and Western Europe, while the Snow campaign targeted a number of other geographies, mostly in South America and APAC. They said this suggested Qakbot’s operators were able to specifically target regional victims based on the requirements of their “customers”.

The backend infrastructure itself was based in Russia, where it has been fully located since early 2021, when, following the disruption of the rival Emotet botnet, its operators pulled out of other geographies, including Germany, the Netherlands and the US. The CTU team observed this infrastructure going quiet at about 11:30 on the evening of Friday 25 August, when the takedown began.

They said the robust efforts made by law enforcement should both reduce the number of infected hosts and hinder any attempts by Gold Lagoon to regain control of the Qakbot botnet.

Speaking as news of the takedown broke, Smith said: “Qakbot was a significant adversary that represented a serious threat to businesses around the world. Engineered for e-crime, Qakbot infections led to the deployment of some of the most sophisticated and damaging ransomware.

“Qakbot has evolved over the years to become a flexible part of the criminal’s arsenal,” he added. “Its removal is to be welcomed.”

Others voiced similar sentiments. Roger Grimes, data-driven defence evangelist at KnowBe4, was among them. “I applaud the FBI and its partners across the globe,” he said. “Wonderful news! These sorts of takedowns used to be fairly rare, but are becoming more common over time. It’s no small feat to coordinate an international takedown.

“It takes lots of technical and legal talent,” said Grimes. “It was great to hear that the FBI had taken over at least one of the criminal servers and used it to redirect exploited nodes to a safer server where the FBI tried to automatically uninstall Qakbot on impacted computers.”

Grimes said that historically, such proactive cleaning up had been rare, and often controversial, as if not done right, things can go very wrong, and there have been instances of well-meaning cyber experts involving themselves and making the situation worse.

“The FBI and its technical partners appear to be doing the clean-up right, with minimal legitimate operational impact,” he said. “I’m glad the FBI and its partners have decided proactive cleanup was worth the risk. It improves not only the lives of the exploited people and organisations who have Qakbot installed, but the next innocent victims.”

Trellix’s John Fokker, head of threat intelligence at the organisation’s Advanced Research Centre, added: “The takedown process is no cakewalk, speaking from experience with our recent involvement in the Genesis Market takedown and REvil arrests. Combating cyber crime takes a respectable amount of dedication and collaboration to pull apart the intricacies of ransomware infrastructures.

“The increase in takedowns and arrests shows that cyber criminals need to watch their backs,” he said. “Law enforcement and the industry alike are seeking every opportunity to disrupt threat actors, and additional takedowns are imminent.”

They’ll be back

However, although the disruption of Qakbot will be a setback to many cyber criminal operations, it will likely do relatively little to combat the scourge of cyber crime in general.

Sandra Joyce, vice-president of Mandiant Intelligence at Google Cloud, said the cyber crime business model had strong underpinnings and would not be easily disrupted. It is likely the ransomware gangs that used it will pivot to other tools, or fall back on the services of initial access brokers, in short order.

“Many of the tools we have at our disposal aren’t going to have long-term effects,” she said. “These groups will recover and they will be back. But we have a moral obligation to disrupt these operations whenever possible.”