[Back to Operation Duck Hunt](https://takedownindex.org/takedowns/operation-duck-hunt)

# Organizations and roles

August 2023, Malware and botnets
[Operation Duck Hunt](https://takedownindex.org/takedowns/operation-duck-hunt)

Last reviewed August 21, 2026

The public record puts 4 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), United States | Operational lead | Redirected botnet traffic to FBI-controlled infrastructure and delivered the uninstaller. |
| | [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation) | Coordinator | Coordinated the European elements of the operation. |
| | [United States Attorney's Office for the Central District of California](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-central-district-of-california), United States | Prosecuting | Obtained the warrants authorizing the redirection and remediation. |
| | [Gendarmerie nationale](https://takedownindex.org/organizations/gendarmerie-nationale), France | Supporting | Participated in the French component of the infrastructure action. |

## Accountability

### Legal authority

US search and seizure warrants including Rule 41 authorization (Central District of California)

### Oversight

The record assigns prosecuting or judicial roles to USAO-CDCA.

### Ongoing investigation

Group accounted for: Partial. DOJ explicitly stated no arrests accompanied the action. The administrator was identified and charged only two years later, and the malware ecosystem resurfaced in the interim.

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026