Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The FBI and Justice Department announced an international operation against the Qakbot botnet on August 29, 2023. Investigators redirected Qakbot traffic through FBI-controlled servers and used it to deliver a file intended to uninstall Qakbot from infected computers. That was a botnet disruption, not a full cleanup: the uninstall did not remove other malware already on a computer.
What happened in the Qakbot takedown?
The operation announced by the U.S. Department of Justice on August 29, 2023, involved authorities in the United States, France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia. DOJ said the FBI had identified more than 700,000 computers worldwide, including more than 200,000 in the United States, that appeared infected at the time. These are historical figures from the operation, not a count of computers infected today.
The operation also seized approximately $8.6 million in cryptocurrency, according to DOJ. The department characterized worldwide damage from Qakbot as hundreds of millions of dollars. That broad damage estimate is distinct from the ransom-payment figure described in an FBI affidavit below.
How did the FBI uninstall Qakbot?
Law enforcement gained access to Qakbot infrastructure and redirected botnet traffic through servers controlled by the FBI. Infected computers communicating through that infrastructure were instructed to download a law-enforcement file designed to uninstall Qakbot and disconnect them from the botnet. DOJ said the action was limited to information installed by Qakbot’s operators and did not involve accessing or changing computer owners’ information.
#1 Best Overall
Then-Attorney General Merrick B. Garland described the operation this way: “Together with our international partners, the Justice Department has hacked Qakbot’s infrastructure, launched an aggressive campaign to uninstall the malware from victim computers in the United States and around the world, and seized $8.6 million in extorted funds.” The statement describes the Qakbot operation; it does not mean every affected computer was free of malware.
What the uninstall did—and did not—remove
The file was intended to remove Qakbot and untether a victim computer from the botnet, preventing further malware installation through Qakbot. DOJ’s victim resource page explicitly warns that the uninstall did not remediate other malware already installed on a computer. A Qakbot uninstall therefore cannot establish that an individual system is secure now.
For the official victim information and the SHA-256 hash DOJ lists for the uninstall file, see DOJ’s Resources for Victims of the Qakbot Malware. The page documents the operation; it is not a current assessment of any particular computer.
Recommended Free Tools
How Qakbot was connected to ransomware losses
Qakbot was used as an initial infection route: attackers could use it to gain a foothold on a computer or network and then install other malware, including ransomware. The FBI affidavit says records indicated that fees paid to Qakbot administrators corresponded to approximately $58 million in ransom payments from October 2021 through April 2023. That figure is not an estimate of total victim losses. DOJ separately described worldwide damage in the hundreds of millions of dollars.
Rank #3
What DOJ alleged about activity after the disruption
On May 22, 2025, DOJ announced an indictment charging Rustam Rafailevich Gallyamov with leading a group that developed and deployed Qakbot. The indictment alleges that Gallyamov and co-conspirators continued criminal activity after the 2023 disruption using other tactics, including spam-bomb attacks. Those are allegations in a criminal case, not findings established here as adjudicated facts. DOJ also announced a civil forfeiture complaint involving cryptocurrency seized during the investigation.
Quick Recap
Best Value
Official sources
- DOJ: Qakbot Malware Disrupted in International Cyber Takedown (August 29, 2023)
- DOJ: Resources for Victims of the Qakbot Malware
- DOJ: Leader of Qakbot Malware Conspiracy Indicted (May 22, 2025)
- FBI affidavit: The Qakbot Malware and Botnet (August 2023)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
