Q is for QakBot — The Loader the FBI Uninstalled From 700,000 Machines

The Alphabet of Actors — Letter Q. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED.

For four letters this register has been telling one grim story in different keys. Mirai showed a conviction that could not un-publish code. NSO showed a court judgment that could not un-teach a business model. OceanLotus showed an attribution that named a company and cost it nothing. Park Jin Hyok showed an indictment that named a man and could not touch him. The refrain has been consistent and bleak: exposure is not consequence, and naming is not a leash.

This letter breaks the refrain. QakBot is the actor that actually lost — not in the sense of being named or shamed, but in the sense of being reached, dismantled, and physically removed from the hundreds of thousands of computers it had colonized. In August 2023, an international law-enforcement coalition led by the FBI did something that had rarely been done at this scale: it took over the botnet's own command-and-control channel and used it to push an uninstaller to roughly seven hundred thousand infected machines, quietly deleting QakBot from the victims it had spent years accumulating. The attacker's own plumbing was turned into the mechanism of its removal.

QakBot deserves its letter for two reasons, then. First, for what it was: not a headline-grabbing ransomware brand but the quiet, load-bearing infrastructure beneath the ransomware economy — the loader, the access broker, the supplier that manufactured footholds and sold them to the crews that did the extorting. And second, for what happened to it: the register's clearest evidence that operational action, as opposed to indictment theater, can impose real cost on the cybercrime ecosystem. This is the letter about the middleman of the ransomware supply chain, and about the one time the good guys reached all the way into the machine and switched it off.

1. The Actor: the middleman, not the headline

To understand why QakBot mattered you have to understand the division of labour in modern cybercrime, because QakBot occupied the least glamorous and most important slot in it. The ransomware attacks that make the news — the hospital locked, the pipeline stopped, the ransom demanded — are the final act of a production line, and the final act depends on an earlier one that almost nobody names: getting inside in the first place. Somebody has to phish the employee, steal the credentials, establish the foothold, and escalate to control of the network before any ransomware can be deployed. That first stage is a business of its own, and QakBot was one of its dominant firms.

QakBot — also called Qbot and Pinkslipbot — began life around 2007 as a banking trojan, a tool for stealing online-banking credentials. Over a decade and a half it evolved into something more valuable: a modular loader and one of the premier initial-access botnets on the internet. Its job was not to encrypt files or demand ransom. Its job was to get in, dig in, and hand the keys to whoever paid. It arrived through phishing — increasingly through reply-chain hijacking, in which the malware inserts its lure into an existing email conversation so that the victim sees a message that appears to come from a colleague mid-thread. Once on a machine, it stole browser data, harvested credentials, read the victim's email to find the next thread to hijack, and reached out for instructions and additional payloads.

That is the profile of an access broker, and it is why QakBot punched so far above its public profile. In the register's own terms, it is upstream of the actors that get the headlines. The extortion crews at letter L bought or received the doors that middlemen like QakBot opened. QakBot was the supplier, the wholesaler of compromise, and precisely because it did not extort anyone directly, it drew less public attention than the brands whose names appear on ransom notes. The most consequential node in a supply chain is often the one nobody can name, and for years QakBot was exactly that.

2. The Tradecraft: how the door got opened

The archive lets us watch QakBot work, because its techniques are so well-documented that they live in the detection rules defenders wrote to catch it — and the specificity of those rules is the best portrait of what the loader actually did on a compromised machine.

The MITRE catalogue records QakBot's inventiveness in evasion — hiding code inside Excel spreadsheets by turning the font white and splitting it across multiple cells so it reads as blank to a human and as instructions to the machine. The Sigma detection rules capture the hands-on-keyboard sequence that followed a successful lure. QakBot used a legitimate Windows utility, esentutl.exe, to extract saved browser data from Internet Explorer and Edge — turning the operating system's own tools into a credential thief. It tampered with the registry to add Windows Defender folder exclusions, carving out safe zones where its files would not be scanned. It manipulated Remote Desktop settings. And, as documented by The DFIR Report and captured in the archive, it chained with the ZeroLogon vulnerability to escalate all the way to full domain compromise — from one phished employee to control of the entire corporate network.

Read that progression as the productization of intrusion. Each step is a deliberate, repeatable move: get in by phishing, steal what is stored, evade the scanner, escalate to domain control, deploy Cobalt Strike, and stand ready to hand the whole network to a paying customer. This is not opportunistic malware stumbling around; it is a disciplined access-manufacturing process, refined over years, that reliably converted a single careless click into a fully-owned enterprise. And the reason the technique matters to a register otherwise full of nation-states is that this is the mundane, industrial floor on which the dramatic attacks are built. Before the ransomware, before the headline, there is a loader doing exactly this, quietly, at scale, all day long.

3. The Supply Chain: selling the door to the arsonists

QakBot's place in the ecosystem is the heart of what makes it distinct, so this section states it plainly: QakBot did not burn the building. It sold the arsonists the key.

Across the 2020-2023 period, QakBot functioned as an initial-access engine for a rotating set of ransomware operations. After establishing its foothold and escalating, it deployed Cobalt Strike — the commercial penetration-testing framework that has become the cybercrime world's standard post-exploitation tool — and then supplied access to affiliated ransomware crews. The names that received QakBot's footholds read like a tour of the era's extortion economy: ProLock, Egregor, DoppelPaymer, Black Basta, and Conti-linked activity among them. QakBot's compromise of a network was frequently the first domino; the ransomware was the last.

This is the structural insight the letter exists to deliver, and it reframes how consequence should be measured. When a ransomware brand is disrupted, the access brokers that fed it simply feed the next brand; the supply is fungible. But disrupt the access broker — the loader that manufactures the footholds — and you strike upstream, at the raw material the whole downstream economy depends on. QakBot was not one crew's tool; it was infrastructure serving many crews, a shared dependency of the ransomware market. That is why taking it down was worth an international operation, and why the operation targeted the botnet's plumbing rather than any single ransom note. You do not drain a swamp by swatting the mosquitoes one at a time. You go after the water. QakBot was the water.

4. Operation Duck Hunt: the machine switched off from inside

In August 2023 the thing this register almost never gets to report actually happened, and it happened with a technical elegance worth describing carefully, because the how is the whole significance.

The operation, publicly called Duck Hunt, was a coalition: the FBI, the United States Justice Department, the Dutch National Police, Europol, and partners across France, Germany, Latvia, Romania and the United Kingdom. What distinguished it from an ordinary server seizure was the method. Law enforcement did not merely grab QakBot's infrastructure and unplug it, which would have left the seven hundred thousand already-infected machines still infected, still colonized, waiting for the operators to rebuild. Instead, investigators gained access to QakBot's own infrastructure, identified the population of infected computers — roughly seven hundred thousand worldwide, about two hundred thousand of them in the United States — and redirected the botnet's traffic to servers under FBI control. From those servers, they delivered to each infected machine a custom uninstaller: a small piece of code that instructed QakBot to remove itself and untether the victim's computer from the botnet, cutting off any further payloads.

Sit with the reversal, because it is beautiful and it is rare. A botnet is a machine for control: the operators broadcast commands down the command-and-control channel, and the infected fleet obeys. Duck Hunt seized the broadcast tower. The same channel the criminals used to push credential-stealers and ransomware loaders was used, one time, to push a command the criminals never wrote — self-destruct — and seven hundred thousand machines obeyed it, because to them it was just another instruction from the infrastructure they were built to trust. The defenders did not knock down the door; they walked in through the front and told the malware to leave. Roughly eight and a half million dollars in illicit cryptocurrency was seized alongside. And this archive holds the fingerprint of that act itself: a YARA rule, written days after the operation, whose entire purpose is to detect the uninstaller files the FBI and Dutch police deployed — the code of the takedown, preserved as a signature. It is the only letter in this alphabet whose primary artifact is the weapon the good guys used.

5. The Limit: the machine, not the men

Having praised the operation honestly, the letter has to bound the praise honestly too, because the success was real but it was not total, and the gap is the second half of the verdict.

What Duck Hunt destroyed was the botnet — the infrastructure and the infected fleet. What it did not do, at least not as part of the operation's announced results, was arrest the operators. The humans who built and ran QakBot, who profited from selling access to ransomware crews, were not among the trophies. And a botnet's code and operators are separable from any particular set of servers: within months, security researchers observed QakBot-associated phishing activity again, the brand and the tradecraft resurfacing even after the fleet that carried its name had been cleaned out. The dismantling was a genuine blow, not a bluff — but it landed on the machine, and the people who owned the machine were still free to build another.

This is the same reachability gap the register keeps finding, and it is worth being precise about what is and is not different here. In the previous four letters, consequence failed to arrive at all: the code stayed published, the model stayed teachable, the company stayed open, the man stayed in Pyongyang. In QakBot's case, consequence genuinely arrived — the botnet really was dismantled, the victims really were cleaned, the money really was seized — but it arrived at the infrastructure rather than at the individuals, and infrastructure is rebuildable while operators remain at large. So the letter records a real win and an honest limit in the same breath. Duck Hunt proved that operational action can impose meaningful cost, which is more than exposure alone ever did. It also proved that dismantling a machine is not the same as ending the people who run it. Both halves are true, and a forensic register keeps them both.

6. The counter-narrative, steelmanned

There are two opposing objections to this letter, and honesty requires facing both — the one that says the takedown was too much, and the one that says it achieved too little.

The first objection is about the method. In Duck Hunt, a government reached into hundreds of thousands of private computers it did not own and executed code on them — the uninstaller — without the individual consent of each machine's owner. However benign the payload, the argument runs, this is a state pushing software onto private property at scale, a precedent that should trouble anyone regardless of the good intentions here; today it is an uninstaller, but the capability and the legal theory that permit it could authorize something less benign tomorrow. The second objection is the mirror image: that for all its cleverness, Duck Hunt accomplished little of lasting value — it cleaned a botnet that the operators could and did begin to rebuild, arrested no one, and amounts to expensive theater that treats a symptom while the disease walks free. On this view QakBot belongs with the rest of the arc after all: another exposure that changed nothing, dressed up in better technology.

The dossier takes both seriously and rejects the conclusion of each. The consent objection is genuine and important, and it should not be waved away: mass remote remediation is a real expansion of state power over private machines, conducted here under court authorization and narrow scope, and it deserves exactly the scrutiny the objection demands — the letter records it as a real precedent, not a costless good. But the alternative to acting was leaving seven hundred thousand victims infected to protect a principle that the victims themselves, asked, would almost certainly have waived; the operation removed a harm from the very machines whose owners bore it. The too-little objection is where the dossier draws its firmest line. It is simply not true that dismantling QakBot changed nothing: the botnet was gone, the victims were cleaned, and millions in criminal proceeds were seized — outcomes categorically more real than the naming-without-effect of the preceding letters. That the operators escaped and the brand twitched back to life is a genuine limit, not a nullification. The correct reading is not "another empty gesture" and not "problem solved," but the harder middle truth: real cost was imposed, and it was not enough. Refusing to celebrate a partial win as total is honesty. Refusing to admit it was a win at all is cynicism, and the seven hundred thousand cleaned machines refute it.

7. Verdict — UNINSTALLED, and UNFINISHED

QakBot was the quiet middleman of the ransomware economy — the loader that turned a phished click into a fully-owned network and sold that access to the crews whose names ended up on ransom notes. It was infrastructure, not headline; supplier, not extortionist; and precisely because it did not demand ransom from anyone, it was for years the most important actor in the ecosystem that almost nobody outside the field could name. Then, in August 2023, it became something rarer than any brand: the botnet that was switched off from the inside.

The verdict's first word is the one this register has been waiting nineteen letters to write about a live criminal actor: UNINSTALLED. Not indicted-in-absentia, not named-and-shamed, not sanctioned-but-undeterred — uninstalled, literally, from roughly seven hundred thousand machines, by an international coalition that seized the botnet's own command channel and used it to tell the malware to delete itself. The victims were cleaned, the money was seized, and the artifact of the operation survives in this very archive as a detection signature for the uninstaller the FBI deployed. After a run of letters about consequence that never came, QakBot is the one where it did.

The second word is the honest boundary of that success: UNFINISHED. The machine was dismantled; the men were not caught. No operator was among the takedown's announced results, and QakBot-associated phishing was seen again within months, the brand and the tradecraft outliving the fleet that carried them. Consequence reached the infrastructure and stopped at the humans — the same reachability gap the register keeps finding, this time inside a real victory rather than in place of one. You can uninstall a botnet from every machine it owns. You cannot uninstall the people who wrote it, and until you reach them, the job is unfinished by design.

Nineteen letters deep, QakBot is the register's proof that the bleak refrain is not a law of nature — that operational action can, in fact, impose real cost, dismantle real infrastructure, and clean real victims, which exposure alone never did. It is also the proof that even the best of these operations stops at the edge of the reachable, that a cleaned botnet is not a caught operator, and that a supply chain with its supplier removed simply grows a new one. The honeypot beneath these words will never see QakBot's command channel, but it sits at the very floor of the access economy QakBot industrialized: the endless credential brute-forcing and foothold attempts that are the raw material every initial-access broker packages and sells upward. Duck Hunt drained one reservoir of that market for a while, brilliantly, incompletely. The vectors do not lie: the loader was real, the supply chain was real, the takedown was real, the limit was real. Judge the middleman that manufactured the doors the ransomware economy walked through. Then credit the operation that reached in and switched it off — and note, without either cynicism or triumph, that the hands that built it are still free to build again.

The Alphabet of Actors continues. Verdict: UNINSTALLED, and UNFINISHED. Confidence: HIGH — QakBot's role as a ransomware initial-access loader, the Operation Duck Hunt takedown (seizure, ~700,000 remediated machines, ~$8.6M seized), and the partial resurgence are matters of public record, corroborated by DOJ filings, MITRE ATT&CK, the Qbot detection-rule corpus, and the uninstaller YARA signature preserved in this archive. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the loader that sold the access, the coalition that switched it off, and the gap between dismantling a machine and reaching the people who ran it.