Google sues two Russians it claims help run a botnet that has infected 1M+ devices and uses command-and-control server addresses stored on Bitcoin's blockchain
- Complaint says the two created a sophisticated ‘botnet’ — Glupteba sells stolen logins, credit cards, Google says Source: The Keyword .
Context & Ripple Effects
Google’s case targets Glupteba as more than a device-infection operation: the complaint ties it to stolen credentials and payment-card data, while its command infrastructure uses Bitcoin’s blockchain to distribute server addresses. That design makes the case a test of whether civil action can complement technical disruption against botnets.
The case later produced a default ruling against the two accused operators, and Google subsequently described such cases as part of an affirmative-litigation policy against cybercrime. The later suit alleging the BadBox 2.0 botnet shows Google continued to use that approach against larger alleged operations.
First-order effects
- The two Russians named by Google face a civil case tied to the alleged operation of Glupteba, while Google seeks to disrupt infrastructure it says supported infections on more than one million devices.
- People whose logins and card data were allegedly sold through Glupteba are the immediate victims identified by Google’s complaint.
Second-order effects
- Glupteba’s use of Bitcoin-stored command-and-control addresses raises the burden for defenders: disrupting a botnet cannot depend only on removing a conventional server address.
- Google’s suit establishes a litigation route it later applied to alleged malware advertisers targeting small businesses and to the alleged BadBox 2.0 operators, broadening the company’s response beyond platform enforcement.
Third-order effects
- If Google continues to pair infrastructure disruption with civil claims, alleged botnet operators face pressure not only on their technical systems but also through court orders and legal costs.
- The case belongs to a wider enforcement challenge in which blockchain-based infrastructure can complicate conventional takedowns, increasing the value of coordinated technical and legal responses.
The trend: Large platforms are increasingly treating civil litigation as a recurring tool alongside technical defenses against botnets and online fraud operations.