Dutch Authorities Take Offline 17-Million-Device Botnet in Major Cyber Operation

AMSTERDAM, May 29 (AP) — Dutch authorities dismantled a massive botnet comprising 17 million infected devices Friday, seizing more than 200 servers in a coordinated operation against cybercriminal infrastructure. The National Cyber Security Centre (NCSC) and the Dutch Police executed the takedown, removing the network from the internet and arresting suspects linked to its operation.

The botnet, which had been active for months, was being used to launch distributed denial-of-service (DDoS) attacks, proxy malicious traffic, and mine cryptocurrency without the knowledge of device owners. Authorities stated the network posed a significant threat to critical infrastructure and private citizens across Europe.

The operation targeted a local hosting provider that had unknowingly or negligently allowed the botnet’s command-and-control servers to operate from its facilities. Police raided the provider’s data centers, physically disconnecting the compromised servers and securing digital evidence for prosecution. The NCSC worked alongside international partners to identify and neutralize the infected devices, which included personal computers, smartphones, and Internet of Things (IoT) gadgets.

Cybersecurity experts described the scale of the operation as unprecedented in the Netherlands. The botnet’s infrastructure was sophisticated, utilizing encryption and rotating IP addresses to evade detection. Authorities noted that the network had been responsible for disrupting services for businesses and government agencies in recent months.

The takedown was part of a broader effort to combat cybercrime and protect national digital infrastructure. The Dutch government has increased funding for cybersecurity initiatives in response to rising threats. Officials emphasized that the operation would not be the last, warning that criminal networks often reconstitute quickly after disruptions.

Victims of the botnet were advised to update their software and run security scans to ensure their devices were no longer compromised. The NCSC released guidance on how to identify and remove malware associated with the network.

While the immediate threat has been neutralized, questions remain about the full extent of the botnet’s activities and whether all infected devices have been cleaned. Authorities are continuing to investigate the individuals behind the network and are coordinating with international law enforcement to trace the financial flows associated with the criminal enterprise.

The operation highlights the growing challenge of securing interconnected digital systems against organized cybercrime. As technology evolves, so do the methods used by attackers, requiring constant vigilance and cooperation among security agencies worldwide.