Botnet of more than 17 million devices dismantled

In a significant operation, Dutch authorities have successfully dismantled a colossal botnet that encompassed over 17 million devices, managed through a network of 200 servers. This collaborative effort involved both the police and the National Cyber Security Center (NCSC) and was announced on Thursday. The initiative was sparked by a security researcher who alerted authorities to the extensive network. The botnet's infrastructure was primarily based in the Netherlands. According to the NCSC, police seized multiple servers associated with the botnet from a hosting provider for further investigation. The provider subsequently took the botnet offline due to its involvement in criminal activities. Reports suggest that this botnet was linked to ASOCKS, a company based in Russia that specializes in providing residential proxy services. These proxies allow users to mask their locations or identities by routing their internet traffic through third-party devices. Unfortunately, such services are often exploited for malicious activities, including Distributed Denial of Service (DDoS) attacks, managing botnet command-and-control operations, executing phishing schemes, and harvesting content from websites. While Ars Technica could not independently verify the claims made by the NL Times, the information aligns with known activities surrounding the botnet. The NCSC's recent post highlighted the critical issues posed by residential proxies, emphasizing their role in facilitating anonymity and bypassing geographical restrictions. This makes it increasingly challenging for organizations in the Netherlands to defend against cybercrime, as attacks can appear to originate from regular traffic sources, complicating mitigation efforts.