Dutch cops wrest 17M devices from mystery botnet's clutches

Dutch police dismantled a large botnet with at least 17 million infected devices. A researcher at the Netherlands’ National Cyber Security Centre provided a tip that led to an investigation. Police discovered 200 servers in the Netherlands that supported the botnet’s infrastructure. Cybercrime specialists seized servers from a hosting provider for further analysis. The hosting provider shut down the botnet after recognizing it was used for criminal purposes. Officials did not disclose the botnet’s name or the specific devices enrolled. They described common abuse types including phishing, DDoS attacks, and online fraud. Guidance emphasized avoiding default passwords, installing apps only from official sources, and keeping software updated. The NCSC-NL also warned about growing residential proxy networks used maliciously.

"Dutch police say they dismantled a large botnet this week comprising at least 17 million infected devices. After being tipped off by a researcher at the Netherlands' National Cyber Security Centre (NCSC-NL), police began an investigation, which resulted in the discovery of 200 servers underpinning the botnet's infrastructure located in the country. Cybercrime specialists at The Hague Police Unit seized a number of servers from a hosting provider for further analysis, and the provider then shut down the botnet after realizing it was being used for "criminal purposes.""

"Botnets can be used for various types of cybercrime, but officials did not say how this botnet in particular was used. Police merely stated the general types of abuse, which include phishing, launching DDoS attacks, and online fraud. Neither the police nor the NCSC-NL revealed the botnet's name - an oddity for takedowns of this kind - and also did not detail exactly what devices were enrolled in it."

"However, both organizations' announcements identified poorly secured consumer-grade kit such as routers, mobile devices, and IoT hardware as common examples. Both also advised users to stop relying on default passwords for new hardware, avoid installing apps from unofficial sources, and keep software up to date. Botnets and residential proxy networks are often mentioned in the same breath, since both require enrolling legitimate devices into a broader network, although they are typically used for different purposes."

Read at theregister