{ "id": "132ec3d6-fdf6-4d0f-b1a9-b828bdd6602b", "created_at": "2026-04-06T00:08:57.011034Z", "updated_at": "2026-04-10T03:20:20.250881Z", "deleted_at": null, "sha1_hash": "813d7d3102a30271fbc8bb1bacb75645540c31ed", "title": "Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 200718, "plain_text": "Qakbot Takedown Aftermath: Mitigations and Protecting Against\r\nFuture Threats\r\nBy The Hacker News\r\nPublished: 2023-12-01 · Archived: 2026-04-05 15:04:03 UTC\r\nThe U.S. Department of Justice (DOJ) and the FBI recently collaborated in a multinational operation to dismantle\r\nthe notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running\r\nthreat, concerns have arisen as it appears that Qakbot may still pose a danger in a reduced form. This article\r\ndiscusses the aftermath of the takedown, provides mitigation strategies, and offers guidance on determining past\r\ninfections.\r\nThe Takedown and Its Limitations\r\nDuring the takedown operation, law enforcement secured court orders to remove Qakbot malware from infected\r\ndevices remotely. It was discovered that the malware had infected a substantial number of devices, with 700,000\r\nmachines globally, including 200,000 computers in the U.S., being compromised at the time of the takedown.\r\nHowever, recent reports suggest that Qakbot is still active but in a diminished state.\r\nThe absence of arrests during the takedown operation indicates that only the command-and-control (C2) servers\r\nwere affected, leaving the spam delivery infrastructure untouched. Therefore, the threat actors behind Qakbot\r\ncontinue to operate, presenting an ongoing threat.\r\nMitigations for Future Protection\r\nhttps://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html\r\nPage 1 of 3\n\nTo safeguard against potential Qakbot resurgence or similar threats, the FBI, and the Cybersecurity \u0026\r\nInfrastructure Security Agency (CISA) recommend several key mitigations:\r\n1. Require Multi-Factor Authentication (MFA): Implement MFA for remote access to internal networks,\r\nparticularly in critical infrastructure sectors like healthcare. MFA is highly effective in preventing\r\nautomated cyberattacks.\r\n2. Regularly Conduct Employee Security Training: Educate employees about security best practices,\r\nincluding avoiding clicking on suspicious links. Encourage practices like verifying the source of links and\r\ntyping website names directly into browsers.\r\n3. Update Corporate Software: Keep operating systems, applications, and firmware up to date. Use\r\ncentralized patch management systems to ensure timely updates and assess the risk for each network asset.\r\n4. Eliminate Weak Passwords: Comply with NIST guidelines for employee password policies and prioritize\r\nMFA over password reliance wherever possible.\r\n5. Filter Network Traffic: Block ingoing and outgoing communications with known malicious IP addresses\r\nby implementing block/allow lists.\r\n6. Develop a Recovery Plan: Prepare and maintain a recovery plan to guide security teams in the event of a\r\nbreach.\r\n7. Follow the \"3-2-1\" Backup Rule: Maintain at least three copies of critical data, with two stored in\r\nseparate locations and one stored off-site.\r\nChecking for Past Infections\r\nFor individuals concerned about past Qakbot infections, there is some good news. The DOJ has recovered over 6.5\r\nmillion stolen passwords and credentials from Qakbot's operators. To check if your login information has been\r\nexposed, you can use the following resources:\r\n1. Have I Been Pwned: This widely known site allows you to check if your email address has been\r\ncompromised in data breaches. It now includes the Qakbot dataset in its database.\r\n2. Check Your Hack: Created by the Dutch National Police using Qakbot's seized data, this site lets you\r\nenter your email address and provides an automatic email notification if your address is found in the\r\ndataset.\r\n3. World's Worst Passwords List: Since Qakbot utilizes a list of common passwords for brute-force attacks,\r\nyou can check this list to ensure your password is not among the worst.\r\nConclusion\r\nWhile the takedown of Qakbot was a significant achievement, the threat landscape remains complex. There is a\r\npossibility of Qakbot's resurgence, given its operators' adaptability and resources. Staying vigilant and\r\nimplementing security measures is crucial to prevent future infections. BlackBerry's CylanceENDPOINT solution\r\nis recommended to protect against Qakbot's execution, and specific rules within CylanceOPTICS can enhance\r\nprotection against threats like Qakbot.\r\nFor additional information and resources on mitigations, visit the DOJ's Qakbot resources page.\r\nhttps://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html\r\nPage 2 of 3\n\nFound this article interesting? This article is a contributed piece from one of our valued partners. Follow us on\r\nGoogle News, Twitter and LinkedIn to read more exclusive content we post.\r\nSource: https://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html\r\nhttps://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://thehackernews.com/2023/12/qakbot-takedown-aftermath-mitigations.html" ], "report_names": [ "qakbot-takedown-aftermath-mitigations.html" ], "threat_actors": [], "ts_created_at": 1775434137, "ts_updated_at": 1775791220, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/813d7d3102a30271fbc8bb1bacb75645540c31ed.pdf", "text": "https://archive.orkl.eu/813d7d3102a30271fbc8bb1bacb75645540c31ed.txt", "img": "https://archive.orkl.eu/813d7d3102a30271fbc8bb1bacb75645540c31ed.jpg" } }