[Back to Operation Ghost Click](https://takedownindex.org/takedowns/operation-ghost-click)

# Organizations and roles

November 2011, Malware and botnets
[Operation Ghost Click](https://takedownindex.org/takedowns/operation-ghost-click)

Last reviewed August 21, 2026

The public record puts 2 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), United States | Operational lead | Led the investigation and executed the technical takeover. |
| | [United States Attorney's Office for the Southern District of New York](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-southern-district-of-new-york), United States | Prosecuting | Charged the defendants. |

## Accountability

### Legal authority

Criminal complaint (SDNY); court-authorized substitute DNS infrastructure

### Oversight

The record assigns prosecuting or judicial roles to USAO-SDNY.

### Ongoing investigation

Group accounted for: Partial. Six defendants charged; only one (based in the US at the time) was reported apprehended promptly, with others pursued through Estonian authorities.

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026