US Seizes $24M in Crypto from Notorious Cybercrime Mastermind Caught in the Act Again

Summary:
The US Department of Justice has filed a civil forfeiture complaint seeking to seize over $24 million in cryptocurrency from Rustam Rafailevich Gallyamov, a Russian national accused of developing the Qakbot malware. The charges against Gallyamov include allegedly operating the botnet and selling access to it for ransomware attacks.

DOJ Seeks Forfeiture of Over $24 Million in Cryptocurrency from Alleged Qakbot Developer

The US Department of Justice (DOJ) has taken a significant step in combating cybercrime by filing a civil forfeiture complaint against Rustam Rafailevich Gallyamov, a 48-year-old Russian national accused of developing the Qakbot malware. According to the DOJ, Gallyamov is allegedly responsible for creating and operating the Qakbot botnet, which was used to infect thousands of computer systems worldwide.

The indictment against Gallyamov, unsealed on May 22nd, outlines a lengthy history of cybercrime activity dating back to 2008. During this period, the alleged Qakbot developer allegedly operated the malware as part of a lucrative business model. Access to computers infected with the Qakbot malware was sold to other parties who would then use it for ransomware attacks.

The affected computer systems were subjected to various types of malicious activities, including but not limited to:

• Ransomware: Gallyamov allegedly used the Qakbot botnet to spread ransomware such as Prolock, Dopplepaymer, Egregor, REvil, Conti, Name Locker, Black Bast and Cactus. These attacks typically involved encrypting vital files on infected computers and demanding payment in exchange for decryption key.

• Data Theft: The Qakbot malware was also used to steal sensitive data from compromised systems. This information could be sold or traded on the dark web.

The impact of the Qakbot botnet was felt globally, with victims spanning multiple continents. Its activities not only disrupted businesses but also led to significant financial losses for individuals and organizations worldwide.

Related Efforts Against Cybercrime

In 2023, a US-led international operation successfully disrupted the Qakbot botnet and malware. The operation resulted in the seizure of over 170 Bitcoin and more than $4 million worth of stablecoins from Gallyamov’s possessions at the time.

However, an examination of the indictment reveals that despite these efforts, Gallyamov and his collaborators continued their illegal activities. They adopted new tactics, including directly deploying ransomware such as Black Basta and Cactus. This demonstrates a level of adaptability and resilience, typical in cybercrime operations.

The DOJ’s actions against Gallyamov are part of its ongoing efforts to counter cybercrime. Matthew Galeotti, head of the DOJ’s criminal division, emphasized this commitment:

"’Today’s announcement of the Justice Department’s latest actions to counter the Qakbot malware scheme sends a clear message to the cybercrime community," said Galeotti.

He added that the department is "determined to hold cybercriminals accountable" and will use every legal tool available. This includes identifying, charging, forfeiting ill-gotten gains, and disrupting their activities.

US Attorney Bill Essayli for the Central District of California reaffirmed this commitment, stating:

"The forfeiture action against more than $24 million in virtual assets also demonstrates the Justice Department’s commitment to seizing ill-gotten assets from criminals in order to ultimately compensate victims."

Assistant Director in Charge Akil Davis of the FBI’s Los Angeles Field Office provided further context about the Qakbot botnet’s disruption. According to Davis, the agency successfully crippled the malware along with its partners in 2023.

Despite this setback, Gallyamov allegedly continued deploying alternative methods to offer his malware to potential partners. This level of perseverance highlights the challenges the DOJ and other agencies face in combating cybercrime.

Conclusion

The US Department of Justice’s actions against Rustam Rafailevich Gallyamov mark a significant step forward in combating cybercrime and forfeiting ill-gotten assets from criminals. The seizure of over $24 million in cryptocurrency is just one aspect of the DOJ’s broader efforts to counter Qakbot malware and disrupt its operations.

As the global battle against cybercrime continues, it remains clear that collaboration between law enforcement agencies, both domestically and internationally, is crucial for success.