The FBI used a court order to seize a key server in the Russia-linked VPN Filter botnet, stopping its ability to reactivate when an infected router is rebooted
FBI agents armed with a court order have seized control of a key server in the Kremlin's global botnet of 500,000 hacked routers, The Daily Beast has learned.
Context & Ripple Effects
The FBI's court-order seizure of a VPNFilter command server is the enforcement move behind the broader response to the Kremlin-linked botnet: days later, the FBI and DOJ asked users to restart their routers and NAS devices so infected machines would phone home to now-seized infrastructure and reveal themselves, with Cisco estimating more than 500,000 affected devices.
The seizure matters because it established a template. The same court-authorized infrastructure-seizure model reappears in the FBI's takedown of the Sandworm-linked Cyclops Blink botnet in 2022, the DOJ's disruption of the RSocks proxy botnet, and the 2024 action against the China-linked Flax Typhoon — each time cutting off command servers rather than chasing individual infections.
First-order effects
- Owners of infected routers immediately lose the botnet's ability to reactivate the malware on reboot, turning a routine device restart from a risk into the FBI and DOJ's recommended diagnostic step.
- VPNFilter's operators lose a core piece of command-and-control infrastructure mid-operation, forcing whatever remains of the botnet onto servers the FBI does not control.
Second-order effects
- Consumer router and NAS vendors face pressure to identify compromised devices and push fixes, since the FBI's remediation plan runs through users manually restarting hardware that cannot patch itself.
- State-linked botnet operators must assume their staging servers are single points of failure subject to US court orders, raising the cost of the rent-a-botnet proxy infrastructure RSocks-style operations depend on.
Third-order effects
- If the pattern holds — VPNFilter, Cyclops Blink, RSocks, Flax Typhoon — seizing command infrastructure by court order becomes the standard US playbook against state-linked botnets, shifting the fight from endpoint cleanup to control-plane capture.
- The recurring involvement of consumer-grade routers and NAS devices points toward sustained regulatory and vendor pressure on baseline security for always-on home network equipment.
The trend: US law enforcement is moving from passively tracking state-linked botnets to actively seizing their command infrastructure through court orders, with each takedown refining the legal template for the next.