[Back to the takedown index](https://takedownindex.org/takedowns) # IPStorm botnet dismantlement November 2023, Malware and botnets Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Extended pass entry, last reviewed August 21, 2026 What was taken down? Botnet infrastructure dismantled in connection with the criminal prosecution. [See what happened](#what-happened) What happened to the people? Officials reported 1 convicted. 1 convicted named in the public record. Group accounted for: Likely complete [See people and accountability](#people) Did it stay down? Not established in the public record. No later activity is recorded against this entry. [See what happened afterward](#afterward) ## What happened DOJ/FBI announced dismantlement of the IPStorm botnet, which had infected tens of thousands of computers and network devices across several continents, alongside developer Sergei Makinin's guilty plea. **Date:** November 2023 **Target:** IPStorm, botnet **Activity:** Malware and botnets **Operational lead:** FBI **Partners** DOJ[[1]](#source-1) - [United States Department of Justice](https://takedownindex.org/organizations/united-states-department-of-justice), prosecuting **Jurisdiction:** Not established **Outcome:** Botnet infrastructure dismantled in connection with the criminal prosecution. **Status:** Completed **Legal mechanism:** Federal criminal prosecution and guilty plea; DOJ CCIPS. **Group accounted for:** Likely complete ## People and accountability Named in the public record: 1 convicted. Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted. Reported and named. Officials reported 1 convicted. 1 convicted named in the public record. The two figures come from different places and are never added together. Officials publish a headline total, and this index counts only the individuals it can name from the cited record. #### Sergei Makinin Developer of IPStorm. Current public status: Pleaded guilty. **Charging authority:** Not established in the public record **Main charges:** Not established in the public record **Case number:** Not established in the public record **Arresting authority:** Not established in the public record **Arrest location:** Not established in the public record **Extradition status:** Not established in the public record **Conviction or plea:** Pleaded guilty, November 1, 2023 **Sentence:** Not established in the public record **Segment:** Core operator **Sources:** [[1]](#source-1) **Full record:** [Everything indexed for Sergei Makinin](https://takedownindex.org/people/sergei-makinin) Group accounted for: Likely complete Sole developer identified, prosecuted, and pleaded guilty. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/ipstorm-botnet-dismantlement/organizations) ## What happened afterward Not established in the public record. No later activity is recorded against this entry. ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [IPStorm botnet developer pleads guilty; botnet dismantled](https://takedownindex.org/sources/us-doj-ccips-ipstorm-botnet-developer-pleads-guilty-botnet-dismantled) US DOJ CCIPS, November 1, 2023, Source grade P1 Establishes the IPStorm dismantlement and Makinin's guilty plea. No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source\_quality capped at S2/P2 pending a dedicated verification pass. Research context ## How this entry was checked This entry came from a broader aggregation pass and has not been independently verified source by source. Its sources are graded no higher than P2 or S2, and most carry no address yet. Treat the figures as a research lead rather than a settled record. Source review: Extended pass, not yet verified Sources cited: 1 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Sinbad cryptocurrency mixer seizure](https://takedownindex.org/takedowns/sinbad-cryptocurrency-mixer-seizure) - [KV Botnet disruption](https://takedownindex.org/takedowns/kv-botnet-disruption) - [Kingdom Market seizure](https://takedownindex.org/takedowns/kingdom-market-seizure) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)