The Demon Qakbot, the Duck That Hijacked Conversations

Legend

Born around 2007-2008 as a banking trojan, Qakbot became one of the great malware loaders: it slipped into existing email reply chains and sold access to ransomware gangs such as Conti, Black Basta and REvil. In late August 2023 Operation Duck Hunt, led by the FBI with France, Germany, the Netherlands, the UK, Romania and Latvia, redirected infected PCs to FBI servers and sent an uninstaller to more than 700,000 machines. Some smaller campaigns have resurfaced, and its alleged leader was indicted in May 2025.

Exorcism

Cast it out by blocking macro, HTML, OneNote and ISO attachments in email. Watch for suspicious replies inside old threads and for odd processes spawned by Office, and enforce MFA and least privilege to slow lateral movement.

Technical record

Also known as: QakBot, QBot, Pinkslipbot, Quakbot
Circle: Circle II · Legions (botnets) · Circle VI · Banking trojans and infostealers · Circle III · Ransomware and extortion
First seen: c. 2007
Status: Exorcised (Operation Duck Hunt, 2023-08-29)
Weapons (exploited CVEs): Saint Follina, Who Opened Word and Called Diagnostics
Works: The Miracle of the Duck Hunt

Qakbot started around 2007-2008 as a banking trojan and became a major malware loader, often hijacking email reply chains to spread and selling access to ransomware gangs. In the FBI-led Operation Duck Hunt in late August 2023, agents redirected infected computers to FBI servers and issued an uninstaller to over 700,000 machines. Smaller campaigns reappeared afterwards and its alleged leader was indicted in May 2025.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference S0650