Yazılar

U.S. Indicts Russian Hacker Behind Qakbot Malware, Unseals Charges Against DanaBot Network

/in /tarafından

The U.S. Department of Justice on Thursday unsealed criminal charges against Russian national Rustam Rafailevich Gallyamov, accusing him of masterminding Qakbot, a long-running malware operation that infected thousands of computers worldwide and facilitated ransomware and cyber fraud schemes.

At the same time, prosecutors also announced charges against 16 individuals allegedly behind the DanaBot malware, part of an international enforcement effort called Operation Endgame.

Qakbot Mastermind Indicted

  • Rustam Gallyamov, 48, of Moscow, is accused of leading a cybercriminal group responsible for developing and deploying Qakbot since the early 2010s.

  • Qakbot was used to:

    • Infect computers with ransomware and other malware

    • Build and operate botnets to control compromised devices

    • Launch further malicious campaigns

  • A federal complaint also seeks the forfeiture of over $24 million in seized crypto and fiat funds linked to the case.

  • The DOJ said Gallyamov remained active in cybercrime operations as recently as January 2025, despite a major 2023 international takedown of Qakbot infrastructure.

  • Gallyamov’s current whereabouts are unknown, and he has not responded to comment requests.

DanaBot Network Brought Down

  • Prosecutors in Los Angeles also unsealed charges against 16 people tied to the DanaBot malware operation.

  • DanaBot has infected more than 300,000 computers globally since 2018 and caused an estimated $50 million in damages.

  • Initially designed to steal banking credentials, DanaBot evolved to include broader information-theft capabilities and enabled unauthorized access for further cybercrime.

  • It was still seeing 1,000 new infections daily across over 40 countries in 2025, according to threat researchers at Black Lotus Labs, a participant in Operation Endgame.

  • This coordinated campaign involved international law enforcement and cybersecurity firms to dismantle infrastructure and arrest perpetrators globally.

Broader Impact

  • These cases illustrate the ongoing and evolving threat of malware and cybercrime, even after major takedowns.

  • The DOJ emphasized that it will continue pursuing cybercriminals operating beyond U.S. borders, often in partnership with global agencies.

Microsoft Takes Legal Action Against Lumma Stealer Malware Infecting 400,000 Devices

/in /tarafından

Microsoft has filed a legal action to disrupt the operations of Lumma Stealer, an advanced piece of information-stealing malware that has infected nearly 400,000 Windows computers worldwide over the past two months, the company said Wednesday.

The action was led by Microsoft’s Digital Crimes Unit (DCU) and involved a court order from the U.S. District Court for the Northern District of Georgia, enabling the takedown, suspension, and blocking of malicious domains that formed the malware’s core infrastructure.

“The growth and resilience of Lumma Stealer highlight the broader evolution of cybercrime and underscore the need for layered defenses and industry collaboration,” Microsoft said in a blog post.

Malware Capabilities

Lumma Stealer targets a wide range of sensitive user data:

  • Extracts information from web browsers, including saved passwords

  • Harvests credentials from cryptocurrency wallets

  • Installs additional malware on compromised systems

It operates as part of a larger cybercrime-as-a-service network, offering malicious tools to third parties for use in data theft and system compromise.

Federal Action and Domain Seizures

In parallel to Microsoft’s civil action:

  • The U.S. Department of Justice announced the seizure of five internet domains tied to the LummaC2 malware infrastructure

  • The FBI’s Dallas Field Office is leading the ongoing criminal investigation

These efforts aim to disrupt the malware’s operations and prevent further infections globally.

Broader Implications

The Lumma Stealer case highlights growing concerns over modular, stealthy malware strains designed to:

  • Evade detection

  • Monetize stolen data

  • Enable subsequent attacks

Microsoft emphasized the need for:

  • Layered cybersecurity defenses

  • Cross-industry cooperation

  • Judicial interventions to combat evolving digital threats

This case adds to a growing list of Microsoft-led legal and technical takedowns aimed at dismantling global cybercrime infrastructure, including recent actions against Storm botnets and ransomware operators.