Global Cybercrime Network Disrupted as DOJ Moves to Return Funds to Victims
In a major international law enforcement operation, the U.S. Department of Justice (DOJ) has seized over $24 million in cryptocurrency linked to Rustam Rafailevich Gallyamov, a Russian national alleged to be a key architect behind the Qakbot malware network. The DOJ announced the civil forfeiture complaint on May 22, intensifying its efforts to dismantle global cybercrime syndicates.
Qakbot: The Digital Plague Since 2008
Qakbot, also known as Qbot, has haunted cybersecurity experts since its inception in 2008. Originally a banking trojan, it evolved into a full-blown botnet infrastructure used to deliver ransomware like REvil, Conti, Black Basta, and Cactus. According to court documents, Gallyamov operated the infrastructure, enabling these devastating attacks on victims across the globe.
The malware infected thousands of devices, often deployed via phishing emails, and granted access to ransomware operators who extorted businesses and public institutions for millions in crypto ransoms.
Gallyamov Allegedly Profited from Ransom Payments
Authorities allege that Gallyamov, operating from Moscow, directly profited from the ransomware schemes, taking a cut from each ransom payment collected by co-conspirators. The DOJ asserts that the seized cryptocurrency was directly traceable to those illicit operations.
The complaint also details how Gallyamov and his associates resumed operations in 2024 using new tactics after the initial Qakbot takedown in August 2023. These included “spam bombing” techniques that tricked employees into opening access to internal networks, allowing continued ransomware deployment into 2025.
Multinational Seizures Reclaim Millions
The August 2023 bust was led by a U.S.-coordinated task force involving Europol, France, Germany, and the Netherlands. That operation recovered 170 BTC and millions in stablecoins. A follow-up seizure on April 25, 2025, led by the FBI’s Los Angeles and Milwaukee field offices, retrieved an additional 30 BTC and $700,000 in USDT and USDC.
The current forfeiture action adds another $24 million to the DOJ’s total recovered assets from the Qakbot operation. The funds, according to prosecutors, are intended to be returned to identified victims.
A Win for DOJ’s Cybercrime Enforcement Strategy
“This case sends a clear message,” said U.S. Attorney Bill Essayli. “We will use every legal and technological tool available to pursue and dismantle the cybercrime infrastructure that threatens U.S. businesses and citizens.”
Assistant U.S. Attorneys from the Central District of California and experts from the DOJ’s Computer Crime and Intellectual Property Section (CCIPS) are leading the prosecution. Officials emphasized that civil forfeiture remains a crucial strategy for disrupting illicit crypto flows and compensating victims.
Spotlight on Crypto and National Security
The operation also raises questions about the use of cryptocurrencies in facilitating international cybercrime. As regulatory bodies increase scrutiny, the Qakbot case is likely to become a reference point in debates over crypto anonymity, ransomware payments, and financial transparency.
Despite the technical anonymity offered by digital currencies, law enforcement agencies have proven increasingly capable of tracing blockchain transactions — especially when coordinated across jurisdictions.
What’s Next for Cybercrime Prosecution?
While Gallyamov remains at large in Russia, where U.S. authorities have limited jurisdiction, the seizure of his digital assets is a powerful symbolic and practical blow to his operations. It also signals the DOJ’s determination to pursue digital perpetrators globally, even if extradition is not currently feasible.
The case highlights a growing trend: the convergence of cybercrime and crypto enforcement is reshaping the global legal landscape. As the crypto ecosystem matures, governments are refining their tactics for targeting bad actors while preserving innovation.
$24M Crypto Takedown Shows No One Is Untouchable
The FBI’s seizure of over $24 million in crypto from a sophisticated Russian malware operation marks a watershed moment in the fight against cybercrime. It sends a powerful message to ransomware operators: crypto anonymity is no shield from justice. With global coordination and blockchain forensics, law enforcement is closing in on digital criminals—one wallet at a time.
