[Back to the takedown index](https://takedownindex.org/takedowns) # Operation Duck Hunt August 2023, Malware and botnets Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? No individual outcomes are recorded against this entry. Group accounted for: Partial [See people and accountability](#people) Did it stay down? After this action the service returned under the same operators, first seen December 2023. The replacement was itself seized in a later action. High confidence in the link between the two. [See what happened afterward](#afterward) ## What happened FBI-led operation that redirected Qakbot botnet traffic to FBI-controlled servers and delivered a court-authorized uninstaller to hundreds of thousands of infected computers.[[1]](#source-1)[[2]](#source-2) Announced August 29, 2023. **Date:** August 2023 **Target:** Qakbot, modular botnet loader **Activity:** Malware and botnets, Ransomware **Operational lead:** FBI **Partners** Europol, USAO-CDCA, and 1 more[[1]](#source-1)[[2]](#source-2) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [United States Attorney's Office for the Central District of California](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-central-district-of-california), prosecuting - [Gendarmerie nationale](https://takedownindex.org/organizations/gendarmerie-nationale), supporting **Jurisdiction:** United States, France, Germany, Netherlands, United Kingdom, Romania, and Latvia **Outcome:** Botnet traffic redirected to FBI infrastructure; uninstaller delivered to approximately 700,000 infected computers; 52 servers seized; approximately 8.6 million USD in cryptocurrency seized. **Status:** Completed **Legal mechanism:** US search and seizure warrants including Rule 41 authorization (Central District of California) **Group accounted for:** Partial ### Infrastructure 52 servers seized and 700,000 malware installations remediated. Cryptocurrency wallets seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | 52 servers | Seized | 52 servers seized as part of the operation.[[1]](#source-1) | | Not published | approximately 700,000 malware installations | Remediated | Approximately 700,000 infected computers received the uninstaller, including roughly 200,000 in the United States.[[1]](#source-1) | | Not published | Cryptocurrency wallet | Seized, United States | Approximately 8.6 million USD in cryptocurrency seized.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Partial DOJ explicitly stated no arrests accompanied the action. The administrator was identified and charged only two years later, and the malware ecosystem resurfaced in the interim. Core group not publicly enumerated at the time of the action. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-duck-hunt/organizations) ## What happened afterward No arrests at the time. Alleged administrator Rustam Rafailevich Gallyamov was charged in 2025 in connection with Operation Endgame.[[1]](#source-1)[[2]](#source-2) December 2023 Qakbot continued operation. Same operators. Confidence: High. Seized in a later action.[[3]](#source-3) DOJ charging documents state that the alleged leader continued malware operations after the 2023 takedown, establishing operator continuity by official attribution. [Later action: Operation Endgame wave 2](https://takedownindex.org/takedowns/operation-endgame-wave-2) Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Qakbot Malware Disrupted in International Cyber Takedown](https://takedownindex.org/sources/united-states-department-of-justice-qakbot-malware-disrupted-in-international-cy) United States Department of Justice, August 29, 2023, Source grade P1 Traffic redirection, uninstaller deployment, server and cryptocurrency seizures, absence of arrests No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Europol release on the Qakbot infrastructure takedown](https://takedownindex.org/sources/europol-europol-release-on-the-qakbot-infrastructure-takedown) Europol, August 29, 2023, Source grade P2 European participation and coordination roles No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 3. [US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency](https://takedownindex.org/sources/united-states-department-of-justice-us-department-of-justice-announcement-chargi) United States Department of Justice, May 22, 2025, Source grade P1 Gallyamov charge, continued operation after the 2023 takedown No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - Charged and apprehended counts of 0 for this action are explicitly established by DOJ and are recorded as 0 rather than null. - Gallyamov's 2025 charge is recorded against the Operation Endgame wave 2 incident, not retroactively against this one. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [LolekHosted seizure](https://takedownindex.org/takedowns/lolekhosted-seizure) - [IPStorm botnet dismantlement](https://takedownindex.org/takedowns/ipstorm-botnet-dismantlement) - [Sinbad cryptocurrency mixer seizure](https://takedownindex.org/takedowns/sinbad-cryptocurrency-mixer-seizure) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)