Loading story…
Polish security authorities, CERT Polska, Spamhaus, home.pl, Austrian CERT, and Group-IB collaborated to disrupt the Virut botnet by seizing or suspending command-and-control domains and redirecting traffic to sinkholes. The action targeted 23 .pl domains and additional infrastructure in .ru, cutting off a major portion of the malware’s control network. Virut, active since 2006, is a file-infecting worm and botnet that spreads through removable drives, network shares, and infected files, and at its peak was linked to hundreds of thousands of compromised systems.
The disruption hit a malware platform that had been used for pay-per-install operations, including delivery of ZeuS and Kehlios, and had also been tied to broader criminal activity such as the re-emergence of the Waledac spam botnet. Researchers warned that the impact might be temporary because parts of Virut’s infrastructure remained outside Polish jurisdiction and the malware used a domain generation algorithm (DGA) that could allow operators to re-establish command and control if they registered newly generated domains. At the time, unresolved infrastructure in the .at namespace remained a notable holdout.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Symantec published analysis describing Virut's domain generation algorithm, noting infected systems could generate up to 10,000 possible domains per day if hard-coded controllers were unreachable.
In December 2012, Spamhaus had Virut command-and-control domains in the .pl ccTLD suspended through various Polish registrars.
CERT Polska reported that more than 890,000 unique IP addresses in Poland were infected by Virut in 2012, underscoring the scale of the threat.
Microsoft conducted a high-profile takedown against the Waledac spam botnet, which later reporting said Virut had been used to redeploy.
Team Furry published research in 2007 linking Virut-related infrastructure to individuals it believed created and operated the botnet, including handles XMAX and Adx.
Virut was first detected in 2006 and went on to become a significant botnet and file-infecting malware threat.
Using evidence and intelligence from Spamhaus, Group-IB's CERT-GIB shut down all Virut domains in the .ru ccTLD within a few hours.
In the days before the report, Spamhaus worked with CERT.pl and home.pl to suspend and sinkhole all Virut command-and-control domains in the .pl ccTLD.
After the December 2012 disruption, Virut operators quickly moved malicious domains to registrar home.pl in an attempt to restore command-and-control.
Polish authorities and NASK began taking control of 23 .pl domains used to operate Virut and redirected their traffic to CERT Polska's sinkhole infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
symantec.com
Open sourcesymantec.com
Open sourcespamhaus.org
Open sourcekrebsonsecurity.com
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft, BitSight, and partners in 35 countries carried out coordinated legal and technical action to disrupt **Necurs**, a long-running criminal botnet used to send massive spam campaigns and deliver malware including ransomware, banking trojans, cryptominers, and credential stealers. Microsoft said Necurs had infected more than **9 million computers**, while BitSight estimated roughly **2 million systems** remained dormant after the botnet’s activity slowed in 2019. A U.S. court order allowed the seizure of U.S.-based infrastructure, and defenders also reverse-engineered Necurs’ domain generation algorithm to predict more than **6 million future domains** for blocking by registries, aiming to cut off both current command-and-control channels and future recovery attempts. The takedown targeted a botnet that had evolved for years into a flexible malware delivery platform with rootkit capabilities and changing monetization tactics. Prior reporting tied Necurs to **Locky** and **Dridex** distribution, pump-and-dump stock spam, `.URL` attachment chains that fetched second-stage loaders over SMB, and selective deployment of tools such as **XMRig** and **FlawedAmmyy RAT** after profiling infected systems for wallets, enterprise environments, and sector-specific targets. Researchers also documented Necurs’ multi-stage domain generation and fallback mechanisms, underscoring why sinkholing and domain blocking were central to the disruption effort and why global remediation by ISPs, CERTs, governments, and law enforcement remained necessary.
Aug 15, 2026
U.S. and European authorities, working with security companies and researchers, disrupted the **GameOver Zeus** peer-to-peer botnet and seized infrastructure tied to **CryptoLocker** in a multinational action known as **Operation Tovar**. The malware network was estimated to have infected **500,000 to 1 million Windows systems** worldwide and was used to steal banking credentials, personal data, and funds through account takeovers, spam campaigns, and DDoS-assisted fraud. U.S. prosecutors said the operation caused more than **$100 million** in losses, while CryptoLocker had infected more than **234,000 computers** and generated over **$27 million** in ransom payments shortly after its emergence. The U.S. Justice Department charged Russian national **Evgeniy Mikhailovich Bogachev**, also known as `Slavik` and `Pollingsoon`, as the alleged administrator behind the botnet. Authorities said the takedown created a roughly **two-week window** for victims and enterprises to clean infected machines before operators could attempt to regain control, and agencies including **US-CERT** and internet service providers were mobilized to support remediation. Investigators said GameOver Zeus spread largely through phishing emails, malicious spam, and compromised websites exploiting outdated software, prompting officials to urge users to update systems, run security scans, and change passwords.
Aug 14, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026