The US Cyber Command, the Defense Department division in charge of its cyberspace operations, recently mounted an operation to disrupt one of the most massive and notorious botnets today. According to The Washington Post, CyberCom successfully (albeit temporarily) interrupted the Trickbot botnet’s operations at least a couple of times over the last few weeks. The botnet is composed of at least a million hijacked computers infected with the Trickbot malware and reportedly run by Russian-speaking criminals.
KrebsonSecurity, which was the first to report on the disruptions, the entity that interrupted the botnet sent infected computers a command that disconnected them from the servers Trickbot’s operators used to control them. Also, the entity filled the Trickbot database with bogus records to confuse the operators. At the time, Krebs didn’t have information on who or what was responsible.