LmCast :: Stay tuned in

Dutch govt disrupts malware botnet with 17 million infected devices

Recorded: May 29, 2026, 3 p.m.

Original Summarized

Dutch govt disrupts malware botnet with 17 million infected devices

News

Featured
Latest

Glassworm botnet disrupted after resilient C2 infrastructure takedown

CISA gives feds 4 days to patch actively exploited cPanel plugin flaw

Windows 11 KB5089573 update released with performance improvements

Charter confirms data breach after ShinyHunters extortion threat

From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market

Dutch govt disrupts malware botnet with 17 million infected devices

Google Chrome adds session cookie theft protection for all users

Learn to hack, build security tools, and more for $70 in this course deal

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityDutch govt disrupts malware botnet with 17 million infected devices

Dutch govt disrupts malware botnet with 17 million infected devices

By Bill Toulas

May 29, 2026
10:26 AM
0

Dutch authorities have taken offline a massive botnet of 17 million devices and seized more than 200 servers at a local provider that supported the operation.
The action was carried out following an investigation from the Police in collaboration with the country's cybersecurity agency, the National Cyber ​​Security Centre (NCSC).
According to the authorities, the seized servers controlled "computers, tablets, and smartphones to carry out cyberattacks."
Botnets are networks of compromised devices used for illegal activities such as distributed denial-of-service (DDoS) attacks, malicious traffic proxying, or cryptocurrency mining.
“The investigation revealed that the botnet consisted of at least 17 million infected devices and that the 200 servers used to host the infrastructure were located in the Netherlands,” the NCSC said.
“ The police subsequently seized several botnet servers from a hosting provider for investigation purposes. The hosting provider took the botnet offline because it was being used for criminal activities.”
Although the authorities did not name the botnet, local media reported that it was linked to a service called Asocks, which advertises itself as a “universal proxy service” with 7 million IP addresses, 150 locations, and 100,000 clients.
The platform offers corporate, residential, and mobile proxies for monthly subscriptions between $5 and $15, with discounts for bulk purchases.
Although such services often comprise IPs that voluntarily donate bandwidth by using a specialized client in exchange for a fee, NCSC’s action indicates that the owners of the devices that were part of the botnet did not knowingly participate in supporting cybercrime operations.
BleepingComputer has contacted Asocks with a request for a comment on the allegations, but we have not received a response by publication time.
To protect networking devices from botnet infections, ensure the default credentials have been changed to something unique and strong, the latest firmware update has been applied, and remote administration panels are disabled when not needed.

The Validation Gap: Automated Pentesting Answers One Question. You Need Six.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate.
Download Now

Related Articles:
The Gentlemen ransomware now uses SystemBC for bot-powered attacksNetherlands seizes 800 servers of hosting firm enabling cyberattacksRussian hackers turn Kazuar backdoor into modular P2P botnetTrickMo Android banker adopts TON blockchain for covert commsGreyVibe hackers use ChatGPT, Gemini to power cyberattacks

Botnet
Legal
Malware
NCSC-NL
Netherlands
Proxy
Residential Proxy

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Charter confirms data breach after ShinyHunters extortion threat

Microsoft Defender can now automatically isolate hacked endpoints

Windows 11 KB5089573 update released with performance improvements

Sponsor Posts

Overdue a password health-check? Audit your Active Directory for free

#1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends.

AI is a data-breach time bomb: Read the new report

33% Rise in Healthcare Credential Theft in 2025: What you need to know

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Dutch authorities initiated a significant action by taking offline a massive malware botnet comprising seventeen million infected devices and seizing over two hundred servers located at a local provider that facilitated the operation. This intervention was the result of a joint investigation conducted by the Police and the National Cyber Security Centre (NCSC). The investigation determined that the seized servers were utilized to control computers, tablets, and smartphones for executing various cyberattacks, which are characteristic of botnets, networks of compromised devices leveraged for illegal activities such as distributed denial-of-service attacks, malicious traffic proxying, or cryptocurrency mining.

The NCSC reported that the investigation revealed the existence of at least seventeen million infected devices and the use of the twenty servers to host the infrastructure within the Netherlands. Furthermore, the authorities seized several botnet servers from a hosting provider, who subsequently took the botnet offline because the infrastructure was actively engaged in criminal activities. Local media reported a potential link between the botnet and a service named Asocks, which markets itself as a universal proxy service offering seven million IP addresses across one hundred fifty locations and supporting one hundred thousand clients. This platform provides proxies for corporate, residential, and mobile use with monthly subscriptions ranging from five to fifteen dollars, offering discounts for bulk purchases. The NCSC’s action implies that the device owners were not knowingly involved in supporting these cybercrime operations.

To safeguard networking devices against future botnet infections, the authorities provided general security recommendations, emphasizing the necessity of changing default credentials to unique and strong passwords, applying the latest firmware updates, and disabling remote administration panels whenever they are not actively needed. This incident underscores the complex nature of botnet infrastructure, involving large-scale compromised endpoints and sophisticated hosting networks essential for executing large-scale cybercrime operations.