Operation Duck Hunt (Qakbot, 2023)
An international FBI-led operation in August 2023 that took control of the Qakbot network of infected machines and remotely uninstalled it from more than 700,000 computers.
Qakbot was an initial access tool: it infected computers through booby-trapped email, then sold or rented that access to ransomware groups that carried out the actual attack. Hitting that link cuts off supply to many groups at once. Investigators redirected the network's traffic to FBI servers, which sent infected machines an uninstall command, with a judge's authorization. The method, acting on victims' computers without their consent to clean them, raises legal questions, but it took down an entire criminal infrastructure in a few days. For insurance, it shows that part of the frequency of ransomware claims depends on law enforcement pressure on a handful of access providers.
On August 29, 2023, the Justice Department announced the operation, carried out with France, Germany, the Netherlands, the United Kingdom, Romania and Latvia: more than 700,000 infected computers were freed and about 8.6 million dollars in crypto assets seized.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.