Qakbot - the takedown and the remediation

Qakbot is a long-running (active since 2008) malware botnet that has been widely used as an initial access vector for numerous high-profile ransomware groups; investigators attribute approximately $58 million in ransoms collected by Qakbot administrators between October 2021 and April 2023, and researchers observed a marked increase in C2 infrastructure and IOCs in late 2022 and early 2023, underscoring its significant ongoing threat to corporate networks.