Dozens of ZeuS Botnets Knocked Offline
Summary: On the evening of Mar. 9, the count of active ZeuS command-and-control servers tracked by ZeusTracker fell from 249 to 181, after an ISP called Troyak, reportedly situated in Kazakhstan, was disconnected from its upstream providers; Troyak served at least six smaller networks also hosting ZeuS C&Cs. Roman Hüssy of ZeusTracker said the average ZeuS C&C controls 20,000 to 50,000 infected machines, and at a conservative 25,000 per server the drop would free more than 1.7 million infected systems, though the machines remain infected.
Bottom line: Troyak found another upstream provider, and ZeusTracker reported active ZeuS C&Cs rising from 149 to 191, with more than 40 back online and criminals able to push fallback-server configs to infected clients - so the 1.7 million machines were never cleaned, only briefly cut off.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026