Use CISA's official AA23-242A advisory. Verify the historical role of QakBot, the responsibilities of each C2 tier, quantitative infrastructure findings, persistence artifacts, and what the disruption did and did not remediate.