Skip to main content
Back to the takedown index

Operation Duck Hunt

August 2023, Malware and botnets
Led by Federal Bureau of Investigation

Verified core entry, last reviewed August 21, 2026

What was taken down?

Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.[1][2]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Partial

See people and accountability

Did it stay down?

After this action the service returned under the same operators, first seen December 2023. The replacement was itself seized in a later action. High confidence in the link between the two.

See what happened afterward

FBI-led operation that redirected Qakbot botnet traffic to FBI-controlled servers and delivered a court-authorized uninstaller to hundreds of thousands of infected computers.[1][2]

Announced August 29, 2023.

Date
August 2023
Target
Qakbot, modular botnet loader
Activity
Malware and botnets, Ransomware
Operational lead
FBI
Partners
Europol, USAO-CDCA, and 1 more[1][2]
Jurisdiction
United States, France, Germany, Netherlands, United Kingdom, Romania, and Latvia
Outcome
Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.
Status
Completed
Legal mechanism
US search and seizure warrants including Rule 41 authorization (Central District of California)
Group accounted for
Partial

Infrastructure

52 servers seized and 700,000 malware installations remediated. Cryptocurrency wallets seized, with no count in the record.

52
servers seized
approximately 700,000
malware installations remediated
Identifier Recorded as Status Notes
Not published 52 servers Seized 52 servers seized as part of the operation.[1]
Not published approximately 700,000 malware installations Remediated Approximately 700,000 infected computers received the uninstaller, including roughly 200,000 in the United States.[1]
Not published Cryptocurrency wallet Seized, United States Approximately 8.6 million USD in cryptocurrency seized.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

DOJ explicitly stated no arrests accompanied the action. The administrator was identified and charged only two years later, and the malware ecosystem resurfaced in the interim.

Core group not publicly enumerated at the time of the action.

See the organizations and roles behind this action

No arrests at the time. Alleged administrator Rustam Rafailevich Gallyamov was charged in 2025 in connection with Operation Endgame.[1][2]

  1. December 2023

    Qakbot continued operation. Same operators. Confidence: High. Seized in a later action.[3]

    DOJ charging documents state that the alleged leader continued malware operations after the 2023 takedown, establishing operator continuity by official attribution.

    Later action: Operation Endgame wave 2

December 2023

Qakbot continued operation. Same operators. Confidence: High. Seized in a later action.[3]

DOJ charging documents state that the alleged leader continued malware operations after the 2023 takedown, establishing operator continuity by official attribution.

Later action: Operation Endgame wave 2

Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Qakbot Malware Disrupted in International Cyber Takedown

    United States Department of Justice, August 29, 2023, Source grade P1

    Traffic redirection, uninstaller deployment, server and cryptocurrency seizures, absence of arrests

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    Europol release on the Qakbot infrastructure takedown

    Europol, August 29, 2023, Source grade P2

    European participation and coordination roles

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  3. [3]
    US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency

    United States Department of Justice, May 22, 2025, Source grade P1

    Gallyamov charge, continued operation after the 2023 takedown

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • Charged and apprehended counts of 0 for this action are explicitly established by DOJ and are recorded as 0 rather than null.
  • Gallyamov's 2025 charge is recorded against the Operation Endgame wave 2 incident, not retroactively against this one.