Homegrown: Rustock Botnet Fed by U.S. Firms
Summary: On March 16, 2011, Microsoft and U.S. marshals served seizure orders at U.S. hosting providers including Wholesale Internet in Kansas City, disconnecting more than 100 Rustock control servers that coordinated spam from hundreds of thousands of infected Windows PCs. Microsoft obtained the authority through a novel reading of the Lanham Act, working with Pfizer over abuse of the Viagra trademark, and also won control of more than 1,500 domain names the botnet could use to rebuild.
Bottom line: Only two of the control servers sat outside the United States, and the average controller lived 251 days - meaning the infrastructure that ran the world's most active spam botnet sat largely undisturbed on small U.S. hosting providers for over eight months at a time.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026