On November 30th, 2016, a worldwide cooperative takedown of the Avalanche botnet took place after more than four years of investigation. “Avalanche” refers to a worldwide crimeware-as-a-service (CaaS) network infrastructure operated by cyber criminals conducting malicious activity. This includes: DDoS, malware distribution, phishing and money-mule operations causing hundreds of millions of damages in Euros worldwide.
The takedown was an international cooperation between law enforcement, cyber-security researchers and organizations allowed to sinkhole, seize and or/block over 800K domains, including those related to the following malwares:
You can read more about the takedown here:
Some cool numbers (from Shadowserver):
To monitor if you are infected, we highly encourage anyone responsibility for internet facing networks to sign up for the free feeds provided by Shadowserver.
To protect our customers, ThreatSTOP has added information for the sinkholes into our TS-Critical Targets. If you have those in your policy, communication from these malwares are automatically blocked and logged.
The newly added Avalanche Targets, available both in Standard and Expert mode (“Avalanche IPs” in IP Firewall product and “Avalanche NSs” in RPZ Firewall product), allows you to see which machines are infected using ThreatSTOP reporting. Note: These targets are of low severity (the malware cannot harm you) but you should still clean them from your network.