Russian telecom giant Rostelecom says it sinkholed part of the Meris DDoS botnet, the world's largest; researchers say the botnet is tied to Windows malware
Catalin Cimpanu / The Record : Tweets: @campuscodi Tweets: Catalin Cimpanu / @campuscodi : Scoop: Rostelecom said it sinkholed part of Meris, the DDoS botnet that broke DDoS records twice this summer as part of its DDoS extortion campaigns The company's security team said it captured 45k of the botnet's estimated 250k bots https://therecord.media/... https://twitter.com/...
Context & Ripple Effects
Rostelecom's security team says it sinkholed roughly 45,000 of the Meris botnet's estimated 250,000 infected machines, the same botnet that broke global DDoS records twice over the summer while powering extortion campaigns against victims. The move lands awkwardly against the company's own history: two years earlier it was accused of [[a:952302|redirecting traffic from more than 200 of the world's largest CDNs and cloud hosts through its network]] in suspected BGP hijacks.
First-order effects
- The sinkhole cuts an estimated 18% of Meris's capacity at the moment the botnet is actively used for DDoS extortion, directly reducing attack pressure on current targets.
- Owners of the Windows machines carrying Meris's malware lose their devices' bandwidth to Rostelecom's capture infrastructure until they clean the infection.
Second-order effects
- A national telecom using its routing position as a defensive chokepoint sets a template other network operators and law enforcement follow — the US DOJ's later disruption of the RSocks proxy botnet shows the same state-led playbook applied to Russian-run infrastructure.
- Meris's operators must rotate command infrastructure and re-recruit bots, raising their operating cost mid-extortion campaign and potentially pushing victims toward paying faster if capacity recovers.
Third-order effects
- Botnet suppression is consolidating around whoever controls traffic plumbing — telcos, registries, and government agencies — rather than antivirus vendors, a shift visible again in the DOJ operation that took down four botnets including the Aisuru and Kimwolf networks behind a record-setting 2025 attack.
- Because Meris spreads through Windows malware, each operator-led takedown raises the stakes on endpoint hygiene: unpatched consumer Windows machines remain the raw material every future record-scale DDoS is built from.
The trend: Large-scale botnet disruption is shifting from endpoint cleanup to infrastructure-level intervention by telcos and state agencies that control where internet traffic flows.