Organizations and roles
Last reviewed August 21, 2026
The public record puts 4 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.
Why this page names organizations only
Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.
Organizations and roles
| Emblem | Organization | Role | What the record says |
|---|---|---|---|
| Federal Bureau of Investigation United States , United States | Operational lead | Redirected botnet traffic to FBI-controlled infrastructure and delivered the uninstaller. | |
| European Union Agency for Law Enforcement Cooperation | Coordinator | Coordinated the European elements of the operation. | |
| United States Attorney's Office for the Central District of California United States , United States | Prosecuting | Obtained the warrants authorizing the redirection and remediation. | |
| Gendarmerie nationale France , France | Supporting | Participated in the French component of the infrastructure action. |
Accountability
Legal authority
US search and seizure warrants including Rule 41 authorization (Central District of California)
Oversight
The record assigns prosecuting or judicial roles to USAO-CDCA.
Ongoing investigation
Group accounted for: Partial. DOJ explicitly stated no arrests accompanied the action. The administrator was identified and charged only two years later, and the malware ecosystem resurfaced in the interim.
This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.
Last reviewed August 21, 2026