FBI Dismantles a Malware System That Took Millions in Ransom

Margi Murphy, Bloomberg News

The seal of the Federal Bureau of Investigation (FBI) hangs on a wall before a news conference at the FBI headquarters in Washington, D.C., U.S., on Thursday, June 14, 2018. Former FBI Director James Comey was "insubordinate" in handling the probe into Hillary Clinton, damaging the bureau and the Justice Department's image of impartiality even though he wasn't motivated by politics, the department's watchdog said today. , Bloomberg

(Bloomberg) -- The FBI said Tuesday that it has taken down a network of hacked devices responsible for extorting tens of millions of dollars from victims around the world.

US officials described the network known as Qakbot as one of the most notorious “botnets” in the world, referring to computer networks that have been infected with malicious software so that they can be controlled remotely without the owner’s knowledge — often to send phishing emails. These emails can in turn be used to hack into victims’ computer systems, which attackers will hold for ransom.

Qakbot was instrumental in enabling cyberattacks against businesses and critical services around the world, according to US officials, including hits on the San Bernardino County Sheriff’s Department and hospitals run by Prospect Medical Group. The latter resulted in the closure of emergency rooms and medical facilities across the US.

“The FBI neutralized this far-reaching criminal supply chain, cutting it off at the knees,” US Federal Bureau of Investigation Director Christopher Wray said in a statement. “The victims ranged from financial institutions on the East Coast to a critical infrastructure government contractor in the Midwest to a medical device manufacturer on the West Coast.

US officials estimated that, since its creation in 2008, Qakbot had infected around 200,000 computers in the US and 700,000 globally.

“Qakbot is a long-standing operation spanning more than a decade that has adapted and evolved with the times — initially focused on traditional banking fraud and later pivoting its focus to act as a foothold to support ransomware intrusions,” said Kimberly Goody, a senior manager at the Google-owned cybersecurity firm Mandiant.

Goody warned that take-downs don’t always result in total disruption of the bad actors behind these botnets, and they may “pivot to underground communities” to find other ways in.

“Any impact to these operations is welcomed as it can cause fractures within the ecosystem and lead to disruptions that cause actors to forge other partnerships — even if it’s only temporary,” Goody said.

(Updates with commentary on the botnet in last three paragraphs)