Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown
Summary: Cisco Talos assesses with moderate confidence that Qakbot-affiliated actors remained active after the late August 2023 FBI-led takedown, running a campaign that began just before it and distributed a variant of Cyclops/Ransom Knight ransomware alongside the Remcos backdoor. Talos linked the new LNK files to the same machine used in earlier Qakbot campaigns, with filenames in Italian and urgent financial themes suggesting phishing emails targeting that region, and concluded the operation affected Qakbot's command and control servers but not its phishing email delivery infrastructure.
Why it matters: The takedown took out command and control servers but left the phishing delivery pipeline intact, so the same operators are still sending emails - now carrying Ransom Knight ransomware and Remcos rather than Qakbot itself.
Read the original at Cisco Talos ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026