![](\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjQtMTIvMDE5M2UwYmEtZGE2Ni03ZjI3LWI3NDAtZmJkNDgyMTRjYWNk.jpg\")
<\/p>\n\n<\/p>\n\n
<\/p>\n
The US Department of Justice (DOJ) has filed a civil forfeiture complaint to seize more than $24 million in cryptocurrency from Rustam Rafailevich Gallyamov, a Russian national accused of developing the Qakbot malware.<\/p>\n
According to a May 22\u00a0announcement<\/a>,\u00a0the DOJ unsealed charges against the 48-year-old Moscovite with a federal\u00a0indictment<\/a>. Gallyamov is allegedly the malware developer behind the Qakbot botnet. <\/p>\n \u201cToday\u2019s announcement of the Justice Department\u2019s latest actions to counter the Qakbot malware scheme sends a clear message to the cybercrime community,\u201d said Matthew Galeotti, head of the DOJ\u2019s criminal division.<\/p>\n Galeotti highlighted that the DOJ is \u201cdetermined to hold cybercriminals accountable.\u201d He added that the department will \u201cuse every legal tool\u201d to \u201cidentify you, charge you, forfeit your ill-gotten gains, and disrupt your criminal activity.\u201d<\/p>\n Related: <\/strong><\/em>Microsoft takes legal action against infostealer Lumma<\/strong><\/em><\/a><\/p>\n US Attorney Bill Essayli for the Central District of California explained that \u201cthe criminal charges and forfeiture case announced today are part of an ongoing effort\u201d to \u201cidentify, disrupt, and hold accountable cybercriminals.\u201d He added:<\/p>\n \u201cThe forfeiture action against more than $24 million in virtual assets also demonstrates the Justice Department\u2019s commitment to seizing ill-gotten assets from criminals in order to ultimately compensate victims.\u201d<\/p><\/blockquote>\n Assistant Director in Charge Akil Davis of the FBI\u2019s Los Angeles Field Office said that Qakbot was crippled by the agency and its partners in 2023. Still, Gallyamov allegedly continued deploying alternative methods to offer his malware to potential partners.<\/p>\n Related: <\/strong><\/em>Chinese printer maker spread Bitcoin stealing malware \u2014 Report<\/strong><\/em><\/a><\/p>\n Gallyamov allegedly operated the Qakbot malware as far back as 2008. In 2019, he allegedly used it to infect thousands of victim computers to establish a so-called botnet.<\/p>\n Access to computers that were part of the botnet was sold to others who infected them with ransomware, including Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Bast and Cactus. In 2023, a US-led international operation\u00a0disrupted the Qakbot botnet and malware<\/a>.<\/p>\n At the time, over 170 Bitcoin (BTC<\/a>) and over $4 million in USDt (USDT<\/a>) and USDC (USDC<\/a>) stablecoins were seized from Gallyamov. According to the indictment, he and his collaborators continued the activity after it was disrupted, adopting new techniques, including directly deploying Black Basta and Cactus ransomware.<\/p>\nOver $24 million forfeited<\/h2>\n
Qakbot used in global ransomware attacks<\/h2>\n