Overview

• The Justice Department unsealed an indictment against Rustam Rafailevich Gallyamov, accusing him of leading the Qakbot malware network since 2008.
• Qakbot infected over 700,000 computers globally and served as an entry point for ransomware gangs, including Conti, REvil, and Egregor.
• Gallyamov allegedly received a share of ransom payments from attacks facilitated by Qakbot, with damages exceeding $58 million in just 18 months.
• The FBI dismantled the Qakbot botnet in 2023, but Gallyamov continued cyberattacks, including spam bomb schemes, into early 2025.
• Over $28 million in cryptocurrency linked to Gallyamov has been seized, with $24 million subject to a newly filed forfeiture complaint.