Researchers Clobber Khelios Spam Botnet
Summary: Security researchers from the Honeynet Project, Kaspersky, SecureWorks and CrowdStrike cracked the encryption controlling the Khelios peer-to-peer botnet and redirected more than 110,000 infected Windows PCs to a server they controlled, a hijack that took only a few minutes. About 80 percent of the sinkholed systems ran Windows XP, 25 percent were located in Poland, and within hours of the takedown a new variant, Khelios.C, was compiled and launched.
Bottom line: The prior Microsoft takedown of an earlier Khelios variant was undone within weeks when the operators rebuilt the network, and this one was followed by Khelios.C within hours - so the 110,000 cleaned machines are a temporary count, not a closed case.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026