Botnet takedowns have become a regular part of international cybercrime enforcement, but the history of major malware operations shows that shutting down command-and-control (C2) infrastructure does not always eliminate the underlying threat. Some of the most persistent botnets were built around mechanisms that allowed infected systems to recover communications, locate replacement infrastructure, or continue operating after central servers were seized. These capabilities have influenced how modern malware developers approach infrastructure redundancy, decentralized communications, and operational recovery.
Malware families such as Conficker, Gameover Zeus, Necurs, Emotet, and QakBot provide useful examples of how these mechanisms developed. Their architectures differed considerably, but each demonstrated that defenders must account for more than the servers actively communicating with compromised devices. Understanding how these botnets survived disruption, and where their recovery mechanisms failed, provides useful direction for detecting and containing modern malware operations.
Domain Generation Algorithms Changed How Botnets Recovered
Early botnets frequently depended on hardcoded IP addresses or domain names to connect infected systems to their operators. This created an obvious weakness. Security researchers and law enforcement could identify the infrastructure, coordinate with hosting providers, and disable the servers responsible for delivering commands. Once these connections were severed, infected devices could lose their ability to receive instructions.
Domain generation algorithms (DGAs) offered a way around this limitation. Rather than storing a fixed list of C2 destinations, a DGA-equipped malware sample calculates potential domains using an algorithm shared with its operators. Inputs can include the current date, a predetermined seed, or other values. The attacker registers a small subset of the generated domains, and infected devices attempt connections until they locate an active endpoint. This allows a botnet to establish new communication channels without modifying every deployed malware sample.
Conficker demonstrated the value of this approach in 2008 and 2009. Earlier variants generated 250 candidate domains per day, creating a significant coordination problem for defenders attempting to prevent registrations. Conficker.C increased the daily pool to 50,000 candidate domains across 116 top-level domains, with infected systems selecting 500 domains to query. This dramatically increased the number of potential rendezvous points that defenders needed to account for.
The approach also created a weakness. A deterministic DGA can be reverse-engineered, permitting defenders to calculate the same domains before the malware attempts to contact them. Sinkholing and coordinated registration blocking can then interfere with the botnet’s ability to recover its C2 infrastructure.
Microsoft’s 2020 operation against Necurs demonstrated this principle at scale. Researchers reverse-engineered the botnet’s DGA and predicted more than six million domains that could be generated over the following 25 months. Working with registries and international partners, Microsoft disrupted the operators’ ability to register these destinations. The case illustrated that domain redundancy can frustrate conventional infrastructure blocking, but it can also create predictable patterns that defenders can exploit.
Peer-to-Peer Networks Removed Central Points of Failure
Other malware developers addressed takedown exposure by reducing their dependence on centralized command servers. Peer-to-peer (P2P) botnets distribute communication responsibilities across infected systems, allowing individual nodes to discover peers, exchange configuration information, and relay traffic through the network.
Gameover Zeus was one of the most significant examples of this architecture. Unlike earlier Zeus variants, which depended heavily on centralized infrastructure, Gameover Zeus used a distributed network of infected hosts and designated proxy nodes. Compromised systems maintained peer information and exchanged messages through a proprietary P2P protocol. Proxy nodes helped relay instructions and stolen information between ordinary bots and the operator-controlled infrastructure.
This architecture made conventional takedowns more difficult. Removing an individual node did not necessarily disconnect the rest of the network, since infected systems could maintain multiple peer relationships. A device that lost communication with one peer could attempt to locate another through its existing peer list. Some nodes were inaccessible to direct inbound connections due to NAT or firewall configurations, introducing further challenges for researchers attempting to enumerate the full botnet.
Gameover Zeus also incorporated recovery mechanisms beyond its primary P2P network. Its fallback channels included hardcoded bootstrap addresses and a date-based DGA capable of locating replacement peer information. When normal P2P communications failed, infected systems had alternative ways to reestablish connectivity.
The malware also used cryptographic signatures to authenticate important updates and configuration data. This distinction matters since a distributed communication system does not necessarily give every participating node authority to issue instructions. An infected device could relay information without being able to forge a valid operator-authorized update. The embedded verification mechanism limited attempts to introduce unauthorized commands or replacement binaries through the P2P network.
Operation Tovar in 2014 demonstrated that decentralized botnets were still vulnerable to coordinated disruption. Researchers and law enforcement exploited weaknesses in Gameover Zeus’s peer-management mechanisms to redirect infected systems into defender-controlled infrastructure. The operation also targeted supporting domains and recovery channels. Its success depended on interfering with several parts of the architecture rather than removing a single C2 server.
The larger technical lesson is that a decentralized botnet must be evaluated as a communication graph. Peer discovery, node reputation, bootstrap mechanisms, cryptographic authentication, and fallback channels all affect whether the network can recover after disruption. Understanding those relationships is often more useful than identifying individual malicious IP addresses.
Redundant Infrastructure Is Only One Form of Persistence
Botnet survival also depends on the ability of operators to rebuild infrastructure after losing access to existing resources. Conficker and Gameover Zeus demonstrated technical recovery mechanisms built into malware itself. Later malware ecosystems showed how relationships between separate criminal services could provide another route back into compromised environments.
Emotet is a particularly useful example. Initially identified as a banking trojan in 2014, Emotet developed into a malware distribution platform used to deliver additional malicious payloads. Its operators maintained an extensive infrastructure for distributing infections, managing compromised devices, and providing access to other cybercriminal groups.
In January 2021, international law enforcement agencies seized portions of Emotet’s infrastructure and redirected infected devices through servers under their control. Investigators used the malware’s normal update mechanisms to interfere with its ability to receive new commands and distribute additional payloads. The operation substantially disrupted the existing botnet.
Emotet nevertheless reappeared in November 2021. Security researchers observed TrickBot infections being used to deliver new Emotet samples, allowing the malware to establish another infection base. Rather than demonstrating that Emotet’s original infrastructure had survived intact, this return showed that an established malware family could be redeployed through an existing criminal distribution network.
TrickBot had already demonstrated a similar ability to continue operating after disruption. Microsoft and industry partners targeted its infrastructure in October 2020, interfering with servers used for malware delivery and ransomware operations. Researchers subsequently observed continued TrickBot activity and its role in helping redistribute Emotet.
These events illustrate the importance of separating malware infrastructure from the broader criminal operation. A botnet can lose its C2 servers, distribution infrastructure, and existing infection base without permanently eliminating the code, technical expertise, or relationships used to rebuild the service. Malware distributors, initial-access brokers, and ransomware operators can maintain separate infrastructure that supports recovery when one component is disrupted.
A Successful Takedown Does Not Guarantee Complete Remediation
QakBot provides another example of the distinction between disrupting a botnet and eliminating all malicious activity associated with it. Originally developed as banking malware, QakBot became a prominent malware delivery platform used to facilitate network intrusions and ransomware deployment.
In August 2023, the FBI and international partners carried out Operation Duck Hunt against QakBot. Investigators identified more than 700,000 infected computers worldwide and redirected botnet communications through infrastructure controlled by law enforcement. Infected systems were instructed to retrieve an uninstaller that removed QakBot and disconnected them from its command infrastructure.
The operation demonstrated a particularly effective approach to botnet disruption: using the existing communication channel to distribute a controlled remediation mechanism. Instead of relying exclusively on blocking traffic, investigators used access to QakBot’s infrastructure to deliver removal instructions to infected systems.
The scope of the remediation remained limited. The uninstaller was intended to remove QakBot, not every other malicious component that might have been installed during the initial compromise. Devices previously affected by QakBot could still contain additional payloads, compromised credentials, persistence mechanisms, or evidence of lateral movement.
The distinction became more significant in 2025, when the U.S. Department of Justice alleged that individuals associated with the QakBot operation had continued criminal activity after the 2023 disruption. According to the indictment, the operators adopted other techniques, including email flooding followed by impersonation of IT support personnel, to obtain access to victim networks. The allegations included activity continuing into January 2025.
QakBot shows that dismantling an infection network can have a substantial operational effect without permanently removing the actors responsible. A successful infrastructure takedown may interrupt one method of gaining and maintaining access, but the same individuals can adopt different delivery mechanisms or work with other criminal services.
Detecting the Communication Patterns That Survive Infrastructure Changes
For security operations teams, the history of these botnets suggests that detection should focus on the behavior of compromised systems rather than relying exclusively on known malicious destinations. Domain and IP reputation remain useful, but malware designed to replace its communications infrastructure can quickly reduce the effectiveness of static indicators.
DGA-based malware can produce recognizable DNS patterns. Depending on its implementation, an infected endpoint may generate bursts of DNS queries, contact domains that have not previously appeared in an organization’s telemetry, or produce unusually high rates of NXDOMAIN responses. Analysts can examine query timing, domain structure, registration history, and associations between originating processes and DNS activity.
No individual characteristic is sufficient to identify a DGA reliably. Legitimate applications, content delivery services, and security products can generate uncommon domains or large numbers of failed queries. Detection logic is more reliable when DNS observations are correlated with endpoint process activity, connection attempts, and patterns that deviate from established application behavior.
P2P malware presents a different detection problem. A compromised workstation may communicate with numerous unrelated external addresses instead of a small number of consistent C2 destinations. This behavior can appear in NetFlow records, firewall telemetry, and network detection systems as repeated outbound connections to unfamiliar hosts, unusual port combinations, or changes in peer relationships over time.
Graph-based analysis can help identify devices whose communications resemble a distributed network rather than conventional client-server behavior. Analysts can examine the number of unique external peers, connection frequency, geographic distribution, and whether multiple internal devices communicate with overlapping sets of external hosts. The presence of encrypted traffic does not prevent this analysis, since connection metadata can still provide useful evidence of unusual communication patterns.
Malware configuration analysis remains equally important. Extracting embedded peer lists, public keys, fallback addresses, and DGA-related parameters can reveal how a sample might recover after losing access to its current infrastructure. These artifacts can also support clustering across malware variants, allowing researchers to associate newly observed infrastructure with known families even after domains and hosting providers change.
Building Defensive Controls Around Recovery Mechanisms
A defensive strategy informed by historical botnets should account for primary communications, backup channels, and secondary access mechanisms. Disrupting an initial C2 destination is useful, but incident responders also need to determine how the malware might reconnect.
Organizations can reduce botnet communication opportunities through controlled DNS resolution, outbound traffic restrictions, and segmentation. Requiring endpoints to use monitored enterprise DNS resolvers improves visibility into suspicious domain activity. Restricting unnecessary direct outbound connections can interfere with malware that attempts to contact arbitrary peers or fallback servers.
Endpoint telemetry should support investigations into process execution, persistence changes, suspicious module loading, and network connections initiated by unexpected applications. A workstation attempting to contact hundreds of external hosts may warrant investigation, particularly when those connections originate from an unsigned executable in a user-writable directory or follow unusual scheduled-task activity.
Threat hunting should also continue after a known botnet has been disrupted. A host that stops communicating with a malicious server is not necessarily clean. The infection may have established additional persistence, delivered secondary malware, or exposed credentials that can still be used independently of the original botnet.
For incident response teams, this means validating remediation at the host and identity levels rather than using the disappearance of C2 traffic as the only success measure. Investigators should examine active processes, persistence artifacts, credential exposure, lateral movement, and connections to other suspicious infrastructure. Depending on the intrusion, removing the original malware may represent just one part of the recovery process.
This approach is especially relevant to malware delivery platforms that support human-operated ransomware intrusions. Once an attacker obtains valid credentials or deploys remote-access tooling, continued access may no longer depend on the original infection. Blocking the loader’s infrastructure does little to address an attacker who has already established a separate foothold.
What Modern Takedowns Can Learn From Earlier Botnets
The influence of these older architectures remains visible in contemporary enforcement operations. International initiatives such as Operation Endgame have increasingly targeted the shared infrastructure used by malware distributors and other criminal services rather than focusing on individual samples. In June 2026, authorities reported neutralizing 326 servers and 142 domains associated with several malware operations, demonstrating the continued importance of coordinated infrastructure disruption.
These operations can significantly reduce the ability of malicious services to distribute payloads, manage infections, and support downstream attacks. Their long-term effect depends on factors beyond the infrastructure removed, including access to remaining infected devices, alternative distribution channels, and whether operators can reestablish the services they previously provided.
Conficker demonstrated how algorithmically generated domains could replace fixed C2 destinations. Gameover Zeus showed how distributed peer relationships and authenticated fallback mechanisms could complicate network disruption. Emotet illustrated how a malware family could return through another established distribution service, and QakBot demonstrated both the effectiveness and the limits of remotely removing malware through a compromised update channel.
The recurring lesson is that botnet persistence extends beyond a collection of malicious servers. It can exist in the malware’s recovery logic, the relationships between infected hosts, the ability to authenticate replacement infrastructure, and the criminal services supporting new infections.
For defenders, the objective is not simply to identify and block the infrastructure a botnet uses today. It is to determine how that infrastructure is selected, how infected systems recover from communication failures, and what additional access remains after the original malware is disconnected. Those questions provide a more complete basis for detecting and containing malware that has been built to survive disruption.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Leave a Reply