Despite a broad effort to disrupt TrickBot, including legal action by Microsoft, some command and control servers of the botnet still appear to be online
As announced today, Microsoft took action against the Trickbot botnet … Alfred Ng / CNET : Microsoft takes down hacking network with potential to disrupt election PYMNTS.com : Microsoft Joins Offensive Against Major Botnet Robert Lemos / Dark Reading : Security Firms & Financial Group Team Up to Take Down Trickbot Ionut Ilascu / BleepingComputer : TrickBot botnet targeted in takedown operations, no impact seen Richi Jennings / Security Boulevard : U.S. Cyber Command Says it Nuked Trickbot, but Microsoft and Chums Claim Credit Derek B. Johnson / SC Media : Microsoft and partners unite to target Trickbot infrastructure in legal takedown Tweets: Catalin Cimpanu / @campuscodi : @Techmeme @briankrebs Yep. Called it earlier today. Definitely gonna fail: https://twitter.com/... TrickBot had a layered C&C communications channel. Tiered backups for backups. Now imagine that Emotet is even more complex than this. Not taking down Emotet anytime soon. Ellen Nakashima / @nakashimae : Microsoft seeks to disrupt Russian criminal botnet it fears could try to sow confusion in the election, but outside researchers say as of Monday afternoon the botnet is still active and adding new victims. w/@greene https://www.washingtonpost.com/ ... @briankrebs : Added some much-needed perspective from Intel 471 on why any attempt to take down Trickbot is likely to fail. tl;dr: Their backup communication method relies on ToR and EmerDNS, which allows the use of domains that can't be taken down by any authority https://krebsonsecurity.com/ ... https://twitter.com/... @briankrebs : Microsoft has executed a sneak attack against the Trickbot botnet, based on novel claims that the ransomware-spreading menace abused its trademarks. The action comes days after U.S. Cyber Command hit Trickbot. However, many Trickbot servers are still up. https://krebsonsecurity.com/ ...
Context & Ripple Effects
This closes a fast-moving week: US Cyber Command announced a temporary disruption of TrickBot on October 10-11, framing it as election protection against an army of 1M+ hijacked machines, and by October 12-13 a private coalition led by Microsoft and Symantec had joined in, with Microsoft filing legal action against the botnet's infrastructure.
The wrinkle reported here is that the combined military and private-sector push did not finish the job — some command-and-control servers stayed online. That partial result matters because it previews what came next: Bitdefender later found the operators had quietly rebuilt much of their operation.
First-order effects
- TrickBot's operators keep at least part of their command-and-control footprint live, meaning infected machines can still receive instructions despite Microsoft's legal action and the coalition's server seizures.
- Microsoft and its partners face immediate pressure to justify the operation's claims — coverage already shows credit-claiming friction between Cyber Command ('nuked') and the vendor coalition.
Second-order effects
- A partial takedown invites reconstitution rather than surrender: Bitdefender's later reporting confirms the group rebuilt much of its infrastructure within months, validating the disruption-not-destruction outcome.
- The mixed result pushes future operations toward deeper law-enforcement involvement — the model the FBI used when it infiltrated and dismantled the Qakbot botnet in 2023 rather than relying on server seizures alone.
Third-order effects
- If the pattern holds, botnet takedowns become recurring maintenance rather than one-time kills: public-private coalitions degrade criminal infrastructure ahead of high-stakes events, while resilient operators treat each disruption as a rebuildable outage.
- That dynamic shifts the industry's measure of success from 'botnet eliminated' to 'downtime imposed per operation,' raising the bar for how vendors and agencies demonstrate impact.
The trend: Botnet defense is settling into a cycle of repeated public-private disruption operations — Cyber Command, vendor coalitions, and eventually FBI-led infiltrations — that impose downtime on criminal infrastructure without permanently eliminating it.