Cyber & Technology — 2026-05-29

Dutch Police Dismantle Botnet of 17 Million Infected Devices in International Operation

BLUFReconstitution of a comparable residential proxy service within six months is likely, as the takedown eliminated infrastructure but left 17 million compromised devices and unidentified operators intact.

The Dutch National Police and National Cyber Security Centre (NCSC) jointly took down 200 servers on May 28, dismantling a botnet of at least 17 million compromised devices including computers, routers, smartphones, and IoT equipment 123. All 200 servers were physically hosted in the Netherlands; police confiscated several from a Dutch hosting provider for forensic examination while the provider terminated the remaining infrastructure 234. The operation began when a security researcher reported the network to the NCSC, which alerted the Cybercrime Team of Police Unit The Hague and initiated a joint investigation 12. Dutch authorities did not publicly name the botnet, but NL Times reported it as Asocks, a commercial residential proxy service that covertly enrolled compromised consumer devices to route traffic and conduct large-scale cyberattacks without owners' knowledge 34.

Analysis
Reconstitution of Asocks or a functionally equivalent service within six months is likely: the takedown neutralized command infrastructure but left the device pool intact, no operator arrests have been reported, and the commercial revenue model sustains incentive to rebuild. Moderate confidence rests on the intact device pool and analogous-service reconstitution patterns, offset by the absence of confirmed operator identity. All sourcing flows from official Dutch releases, constraining confidence specifically on the Asocks attribution. Three coordinated European proxy disruptions within twelve months may raise reconstitution costs materially above historical single-incident rates, pushing the probability toward the lower bound of likely. Regardless of outcome, defenders should treat the still-infected device pool as an active persistent threat; a failed reconstitution would instead elevate the Dutch ISP-cooperation model as a replicable enforcement template.
6 sources
  1. Politie en NCSC halen groot botnetwerk offline - Politie.nl
  2. Gezamenlijke actie politie en NCSC legt groot botnetwerk plat
  3. NCSC and Dutch police disrupt global botnet controlled via Netherlands-based servers - NL Times
  4. Dutch police disrupts botnet composed of 17 million devices - Help Net Security
  5. Dutch govt disrupts malware botnet with 17 million infected devices - BleepingComputer
  6. Dutch cops wrest 17M devices from mystery botnet's clutches - The Register

View in full brief →

UNCLASSIFIED // OPEN SOURCE