A federal indictment has been unsealed, charging Rustam Rafailevich Gallyamov, 48, of Moscow, Russia, with leading a group of cybercriminals who developed and deployed the Qakbot malware.
In connection with the charges, the Justice Department filed a civil forfeiture complaint on May 22 against over $24 million in cryptocurrency seized from Gallyamov during the course of the investigation.
These actions are the latest step in an ongoing multinational effort by the United States, France, Germany, the Netherlands, Denmark, the United Kingdom, and Canada to combat cybercrime.
“Today’s announcement of the Justice Department’s latest actions to counter the Qakbot malware scheme sends a clear message to the cybercrime community,” said Matthew R. Galeotti, Head of the Justice Department’s Criminal Division. “We are determined to hold cybercriminals accountable and will use every legal tool at our disposal to identify you, charge you, forfeit your ill-gotten gains, and disrupt your criminal activity.”
“The criminal charges and forfeiture case announced today are part of an ongoing effort with our domestic and international law enforcement partners to identify, disrupt, and hold accountable cybercriminals,” said U.S. Attorney Bill Essayli for the Central District of California. “The forfeiture action against more than $24 million in virtual assets also demonstrates the Justice Department’s commitment to seizing ill-gotten assets from criminals in order to ultimately compensate victims.”
“Mr Gallyamov’s bot network was crippled by the talented men and women of the FBI and our international partners in 2023, but he brazenly continued to deploy alternative methods to make his malware available to criminal cyber gangs conducting ransomware attacks against innocent victims globally,” said Assistant Director in Charge Akil Davis of the FBI’s Los Angeles Field Office.
According to court documents, Gallyamov developed, deployed, and controlled the Qakbot malware from 2008 onwards. From 2019 onward, Gallyamov allegedly used the Qakbot malware to infect thousands of victim computers around the world in order to establish a network, or “botnet,” of infected computers.
As alleged, once Gallyamov gained access to the victim’s computers, he provided access to co-conspirators who infected the computers with ransomware, including Prolock, DoppelPaymer, Egregor, REvil, Conti, NameLocker, Black Basta, and Cactus.
In exchange, Gallyamov allegedly received a portion of the ransoms paid by ransomware victims.
The announcement of charges on May 22 is the latest step taken by the Justice Department against the Qakbot conspiracy.
In August 2023, a U.S.-led multinational operation disrupted the Qakbot botnet and malware. At that time, the Justice Department announced the seizure of illicit proceeds from Gallyamov, including over 170 Bitcoin and more than $4 million in USDT and USDC tokens.
According to the indictment, after the disruption and takedown of the Qakbot botnet, Gallyamov and his co-conspirators continued their criminal activities. Instead of a botnet, they allegedly employed different tactics, including “spam bomb” attacks on victim companies, where co-conspirators would trick employees at those companies into granting access to their computer systems.
The indictment alleges that Gallyamov orchestrated spam bomb attacks against victims in the United States as recently as January 2025. It also alleges that Gallyamov and his co-conspirators deployed Black Basta and Cactus ransomware on victim computers.
On April 25, 2025, pursuant to a seizure warrant, the FBI seized additional illicit proceeds from Gallyamov, including over 30 bitcoin and over $700,000 of USDT tokens.
The department filed a civil forfeiture complaint in the Central District of California against all the illicit proceeds seized from Gallyamov, valued at over $24 million as of today, to forfeit and ultimately return those funds to the victims.
