Loading story…
Dutch authorities shut down 143 command-and-control servers tied to the Bredolab botnet and arrested a suspected operator in Yerevan, Armenia, disrupting a malware distribution network that police said had infected roughly 30 million computers worldwide. First identified as a downloader operation and later expanded into a botnet, Bredolab spread through compromised legitimate websites, obfuscated JavaScript including Trojan-Downloader.JS.Pegel, and exploit kits targeting vulnerabilities in Adobe Reader, Java, and MDAC.
The botnet acted primarily as a malware delivery platform, installing additional payloads for partners such as Zbot, SpyEyes, TDSS, and ransomware, while also stealing FTP credentials with Trojan-PSW.Win32.Agent.qgg to compromise more websites and sustain infections. Its operators used fast-flux and double-flux proxy infrastructure to hide backend systems, illustrating how website compromise, traffic redirection, exploit delivery, credential theft, and resilient hosting combined to make Bredolab one of the era’s largest criminal malware operations.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
A person formerly responsible for running the Bredolab botnet was arrested at Yerevan international airport in Armenia the day after the server takedown. The arrest followed the Dutch action against the botnet's infrastructure.
Dutch authorities announced the shutdown of 143 Bredolab botnet control servers. Police said the botnet comprised about 30 million infected computers worldwide.
In summer 2010, Bredolab operators reverted from Pegel-based delivery back to hidden iframe tags on compromised websites. This marked another change in the botnet's web-based infection chain.
In late 2009, Bredolab operators replaced hidden iframes on compromised websites with obfuscated JavaScript known as Trojan-Downloader.JS.Pegel. The script decrypted in the browser and inserted links to malicious exploit resources into web pages.
By mid-2009, Bredolab had developed from malware into a botnet operation. It functioned primarily as a downloader that installed additional malware on victim systems.
Security researchers first detected the Backdoor.Win32.Bredolab malware in mid-2008. The malware later became the core loader used by the broader Bredolab operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police and the Netherlands’ National Cyber Security Center disrupted a botnet spanning roughly **17 million infected devices** by taking offline about **200 servers** hosted in the Netherlands. Authorities said the network included compromised computers, mobile phones, IoT devices, and routers, and that the investigation began after a security researcher alerted NCSC-NL. While officials did not publicly name the botnet, reporting tied the infrastructure to **Asocks**, a commercial residential and mobile proxy service, and to prior research on covert proxy enrollment through the **PROXYLIB** library and **LumiApps SDK** ecosystem. The takedown highlights growing abuse of **residential proxy networks**, which can mask malicious traffic behind trusted consumer IP addresses and support operations including **DDoS attacks, spam, credential stuffing, brute-force attacks, click fraud, SMS pumping, phishing, online fraud, and malware delivery**. The action follows broader Dutch enforcement against malicious infrastructure, including the seizure of more than **800 servers** tied to **THE.Hosting**, a Russian-linked bulletproof hosting network associated with scanning, botnet recruitment, cryptomining, credential theft, and exploitation of exposed services; researchers said that operation had limited effect because much of the network’s routed infrastructure remained active across multiple countries.
Jun 29, 2026
An international law enforcement operation dubbed **Operation Endgame** disrupted major malware delivery and botnet infrastructure tied to **IcedID, SmokeLoader, SystemBC, Pikabot, Trickbot**, and remnants of **Bumblebee**, in what Europol and participating agencies described as the largest action of its kind against botnets. Authorities said the networks had been used to spread malware through hundreds of millions of phishing emails and to enable follow-on ransomware attacks and financial fraud, with investigators identifying several million infected computers worldwide over the past year. The coordinated action, supported by **Europol** and **Eurojust**, took down more than **100 servers**, seized over **2,000 domains**, and disinfected more than **10,000** infected systems, while additional operations across multiple countries led to arrests, interrogations, searches, and server seizures. Investigators also identified a key suspect allegedly linked to **69 million euros** in cryptocurrency proceeds, and separate reporting and research highlighted scrutiny of a **SmokeLoader** actor targeted as part of the crackdown.
Jun 29, 2026
Microsoft, BitSight, and partners in 35 countries carried out coordinated legal and technical action to disrupt **Necurs**, a long-running criminal botnet used to send massive spam campaigns and deliver malware including ransomware, banking trojans, cryptominers, and credential stealers. Microsoft said Necurs had infected more than **9 million computers**, while BitSight estimated roughly **2 million systems** remained dormant after the botnet’s activity slowed in 2019. A U.S. court order allowed the seizure of U.S.-based infrastructure, and defenders also reverse-engineered Necurs’ domain generation algorithm to predict more than **6 million future domains** for blocking by registries, aiming to cut off both current command-and-control channels and future recovery attempts. The takedown targeted a botnet that had evolved for years into a flexible malware delivery platform with rootkit capabilities and changing monetization tactics. Prior reporting tied Necurs to **Locky** and **Dridex** distribution, pump-and-dump stock spam, `.URL` attachment chains that fetched second-stage loaders over SMB, and selective deployment of tools such as **XMRig** and **FlawedAmmyy RAT** after profiling infected systems for wallets, enterprise environments, and sector-specific targets. Researchers also documented Necurs’ multi-stage domain generation and fallback mechanisms, underscoring why sinkholing and domain blocking were central to the disruption effort and why global remediation by ISPs, CERTs, governments, and law enforcement remained necessary.
Aug 15, 2026