Polish Takedown Targets ‘Virut’ Botnet
Summary: Poland's domain registrar NASK took control of 23 .pl domains used to run the Virut botnet and redirected their traffic to a sinkhole run by CERT Polska. CERT Polska said over 890,000 unique IP addresses in Poland alone were reported infected by Virut in 2012, while Symantec estimated the botnet's size at 300,000 machines and Kaspersky attributed 5.5 percent of third-quarter 2012 malware infections to it.
Key Takeaway: Many of Virut's control servers sit at Russian registrars outside NASK's reach, and the malware carries a domain generation algorithm that checks one of 10,000 possible domains each day, so registering a single one of those domains could restore the criminals' control.
Read the original at Krebs on Security ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026