Microsoft assists law enforcement in disrupting Dorkbot, a botnet that controlled 1M PCs worldwide
Context & Ripple Effects
Microsoft's move against Dorkbot extends a 2015 pattern of joint police-industry botnet disruptions — months earlier, US and European police took down the elusive Beebone botnet using the same law-enforcement-plus-vendor template. What makes Dorkbot notable is scale: roughly a million infected PCs under one operator's control.
The playbook only grew from here: Microsoft later coordinated the Necurs takedown across partners in 35 countries and joined the TrickBot coalition with Symantec and ESET, making this early action a data point in an evolving corporate anti-botnet strategy.
First-order effects
- About 1 million PC owners are cut off from attacker control overnight, losing Dorkbot's malware payload on their machines as the command infrastructure is severed.
- Dorkbot's operators lose their installed base and revenue-generating botnet capacity, forcing them to rebuild from scratch or abandon the operation.
Second-order effects
- Microsoft converts a one-off enforcement action into a repeatable legal-and-technical playbook, scaling it through the multi-company TrickBot coalition and the 35-country Necurs operation.
- Other security vendors get pulled into coalition takedowns — Symantec and ESET joined the TrickBot effort — because no single company's telemetry covers enough of the infected base.
Third-order effects
- Botnet disruption becomes a standing public-private function rather than episodic policing, though the TrickBot experience — where some command servers stayed online despite legal action — shows these campaigns deliver disruption, not eradication.
- If the pattern holds, large platform vendors increasingly act as de facto cyber-enforcement actors, with their legal teams and threat-intelligence divisions shaping how botnet crime is fought.
The trend: Botnet takedowns have evolved from one-off police raids like Beebone into recurring vendor-led coalitions, with Microsoft turning court-backed infrastructure seizure into standard practice.