US DOJ seizes $24M in crypto from accused Qakbot malware developer

The US Department of Justice (DOJ) has initiated a civil forfeiture action to seize over $24 million in cryptocurrency from Rustam Rafailevich Gallyamov, a Russian national indicted for developing the Qakbot malware. This action, announced on May 22nd, is part of an ongoing effort to combat cybercrime and hold perpetrators accountable.

Gallyamov, a 48-year-old Moscow resident, is accused of creating the Qakbot botnet, a sophisticated malware operation active since at least 2008. The botnet infected thousands of computers, providing access to cybercriminals who deployed various ransomware strains, including Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Basta, and Cactus.

The DOJ’s action underscores its commitment to utilizing all legal avenues to identify, prosecute, and financially cripple cybercriminals. The seized cryptocurrency represents ill-gotten gains derived from Gallyamov’s alleged activities. The forfeiture will also aid in compensating victims of the ransomware attacks facilitated by the Qakbot botnet.

Matthew Galeotti, head of the DOJ’s criminal division, emphasized the department’s determination to hold cybercriminals accountable, stating that they will employ every available legal tool to disrupt criminal activities and seize assets. US Attorney Bill Essayli for the Central District of California echoed this sentiment, highlighting the forfeiture action as a key component of the ongoing efforts to combat cybercrime.

In 2023, a joint international operation successfully disrupted the Qakbot botnet, leading to the seizure of over 170 Bitcoin and millions of dollars in stablecoins. Despite this disruption, Gallyamov allegedly continued his operations, adopting new techniques and deploying ransomware directly. The indictment details his alleged continued involvement in deploying Black Basta and Cactus ransomware, even after the initial takedown. The DOJ’s seizure of the additional $24 million in cryptocurrency represents a significant blow to Gallyamov and demonstrates a continued commitment to combating cybercrime and protecting victims.