Skip to main content
Back to the takedown index

VPNFilter botnet disruption

May 2018, State sponsored
Led by Federal Bureau of Investigation

Extended pass entry, last reviewed August 21, 2026

What was taken down?

Domain seized; infected-device contacts redirected to FBI-controlled infrastructure, allowing victim IP addresses to be passed to remediation partners such as Shadowserver.

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

A W.D. Pennsylvania court authorized the FBI to seize a domain used in VPNFilter's command-and-control and reinfection mechanism, targeting malware that had compromised networking devices worldwide.

Date
May 2018
Target
VPNFilter (attributed to Russia-linked Sandworm), botnet
Activity
State sponsored
Operational lead
FBI
Partners
Shadowserver[1]
Jurisdiction
Not established
Outcome
Domain seized; infected-device contacts redirected to FBI-controlled infrastructure, allowing victim IP addresses to be passed to remediation partners such as Shadowserver.
Status
Completed
Legal mechanism
Court-authorized domain seizure (W.D. Pa.)
Group accounted for
Not applicable

Infrastructure

1 domain seized.

1
domain seized
Identifier Recorded as Status Notes
Not published 1 domain Seized, United States Domain used in the VPNFilter C2/reinfection mechanism.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    VPNFilter botnet C2 domain seizure

    US DOJ / USAO WDPA, May 23, 2018, Source grade P1

    Establishes the court-authorized domain seizure and redirection used to disrupt VPNFilter.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.