Loading story…
A coordinated effort by FireEye, Spamhaus, CERT-GIB, and independent researchers disrupted Grum, one of the world’s largest spam botnets, by taking down its command-and-control infrastructure across multiple countries. The operation first removed a Dutch server, then shut down a Panamanian server that permanently disabled one of Grum’s two operational segments. After the botnet’s operators shifted control to six new secondary servers in Ukraine while retaining a primary server in Russia, defenders shared intelligence with providers and partners to force those systems offline as well, including null-routing the Russian node through its upstream network.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
On August 20, Krebs on Security published a deeper look inside the Grum botnet. The report added technical and operational context to the already documented takedown.
On August 16, Spamhaus published a retrospective describing the collapse of Grum and the emergence of Festi as a successor spam botnet threat. This marked a broader shift in the spam botnet landscape after Grum's disruption.
By July 24, reporting indicated that Grum's operators had tried to restore the botnet after the takedown but were unsuccessful. This showed the disruption had held despite follow-on recovery attempts.
FireEye published details of the coordinated three-day operation and said the world's third-largest spam botnet had been effectively knocked down. The report highlighted the significance of disrupting infrastructure in Russia and Ukraine.
Following the takedown, Spamhaus data showed Grum-related spam-sending IPs falling from roughly 120,000 per day to 21,505. The figures reflected actively spamming bots rather than the botnet's full infected population.
By July 18 at 11:00 AM PST, all six Ukrainian servers and the original Russian primary server were offline, effectively knocking down the Grum botnet. The Russian server was reportedly null-routed by its upstream provider.
During the takedown effort, FireEye provided intelligence on the replacement infrastructure to Spamhaus, CERT-GIB, and researcher Nova7. This coordination supported action against the newly identified servers.
After losing infrastructure, the botnet's operators attempted to reconstitute command-and-control by standing up six new secondary servers in Ukraine while retaining a Russian primary server. The move was a direct attempt to keep the botnet operational after the Panama disruption.
On July 17, defenders succeeded in taking down a Grum command server in Panama. FireEye said this permanently killed one of the botnet's two operational segments.
A Dutch command-and-control server used by the Grum spam botnet was taken offline as part of the early phase of a coordinated disruption effort. This preceded the final takedown and forced the operators to rely on remaining infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourcespamhaus.org
Open sourcetheverge.com
Open sourcehelpnetsecurity.com
Open sourcekrebsonsecurity.com
Open sourcefireeye.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Polish security authorities, **CERT Polska**, Spamhaus, home.pl, Austrian CERT, and Group-IB collaborated to disrupt the **Virut** botnet by seizing or suspending command-and-control domains and redirecting traffic to sinkholes. The action targeted 23 `.pl` domains and additional infrastructure in `.ru`, cutting off a major portion of the malware’s control network. Virut, active since 2006, is a file-infecting worm and botnet that spreads through removable drives, network shares, and infected files, and at its peak was linked to hundreds of thousands of compromised systems. The disruption hit a malware platform that had been used for **pay-per-install** operations, including delivery of **ZeuS** and **Kehlios**, and had also been tied to broader criminal activity such as the re-emergence of the **Waledac** spam botnet. Researchers warned that the impact might be temporary because parts of Virut’s infrastructure remained outside Polish jurisdiction and the malware used a **domain generation algorithm (DGA)** that could allow operators to re-establish command and control if they registered newly generated domains. At the time, unresolved infrastructure in the `.at` namespace remained a notable holdout.
Aug 15, 2026
U.S. and international law enforcement dismantled the **Qakbot** botnet by seizing control of key infrastructure, redirecting infected systems to FBI-controlled servers, and remotely pushing an uninstaller to compromised Windows hosts. Court records show the FBI obtained authority to use remote access techniques against U.S.-based computers communicating with Qakbot, a long-running malware platform also known as **Qbot** and **Pinkslipbot**, after identifying roughly **700,000 infected computers worldwide**, including about **200,000 in the United States**. The operation collected limited technical data such as IP and routing information, but did not capture communication content. Researchers said the disruption also neutralized active infections by sending Qakbot’s own shutdown command through its named-pipe mechanism, preventing the malware from relaunching after a reboot. The takedown targeted a botnet widely used as an initial access platform for ransomware groups including **Conti**, **REvil**, **Egregor**, **MegaCortex**, **ProLock**, and **Black Basta**. Investigators linked Qakbot operators to fees associated with about **$58 million** in victim ransom payments between October 2021 and April 2023, underscoring the botnet’s central role in corporate intrusions and downstream ransomware attacks.
Aug 15, 2026
U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — **Aisuru, KimWolf, JackSkid, and Mossad** — that collectively compromised more than **three million** internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable **DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers**, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting **U.S. Department of Defense** systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above **30 Tbps**, with one attack reaching roughly **31.4 Tbps**, placing them among the largest DDoS threats recorded. The operators allegedly ran the infrastructure as a **DDoS-for-hire** service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s **BKA** and Canada’s **RCMP** carried out parallel enforcement steps. Private-sector partners including **Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation** supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.
Jun 29, 2026