iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In early 2009, a University of California, Santa Barbara (UCSB) team briefly redirected Torpig’s command-and-control traffic by registering domains that infected computers were programmed to contact. The researchers observed the botnet for ten days, collecting live evidence of its operation before Torpig’s operators changed the malware and took control back. This was a temporary redirection of communications—not a law-enforcement seizure or permanent takedown.
What Torpig was built to do
Torpig—also called Sinowal or Anserin in contemporary coverage—was a credential-stealing malware botnet. Infected computers sent information such as online-banking credentials, credit-card data, browsing records and other personal information to infrastructure controlled by the operators.
The UCSB work is documented in the 2009 ACM CCS paper Your Botnet is My Botnet: Analysis of a Botnet Takeover, by Brett Stone-Gross and coauthors. The study is a historical account of one botnet’s operation in early 2009; it does not establish whether Torpig remains active today.
How the researchers redirected Torpig
They exploited domain flux
Torpig used a domain-flux system: infected machines periodically generated or selected changing domain names to find their command-and-control (C&C) server. The UCSB team determined which domains the malware would seek and registered those domains before the infected machines were scheduled to contact them.
#1 Best Overall
When a victim computer requested one of those domains, the request reached infrastructure controlled by the researchers. That allowed the team to receive the botnet’s communications and study the data in real time.
Domain flux is not fast flux
The terms describe different evasion techniques:
- Domain flux: a botnet changes the domain names its malware uses to locate C&C infrastructure.
- Fast flux: a domain name is repeatedly mapped to changing IP addresses, making the underlying server harder to identify or block.
The Torpig takeover described in the UCSB account centered on domain flux. The researchers obtained control of selected rendezvous domains; they did not seize the criminals’ physical servers.
It was a controlled observation, not a permanent takeover
For ten days, the team operated the redirected communications and observed the live botnet. The researchers did not gain indefinite authority over every part of Torpig, and they did not dismantle the infected machines. Torpig’s operators later released an updated malware binary that directed infected computers to different domains—ones the researchers did not own—ending the team’s control.
What the ten-day study revealed
The UCSB paper reports the following measurements for its observation window:
| Measurement | Historical result | Qualification |
|---|---|---|
| Infected machines observed | More than 180,000 | Reported by the UCSB authors for the ten-day 2009 study |
| Data collected | Almost 70 GB | Reported by the UCSB authors; “almost” is part of the original qualification |
| Banking credentials | 8,310 accounts at more than 400 financial institutions | Reported by Dark Reading in its May 4, 2009 account of the UCSB findings |
| Credit and debit card accounts | 1,660 | Reported by Dark Reading in the same contemporary account |
These are separate measurements, not a single combined victim count. They describe what the researchers saw during those ten days and should not be read as current figures for Torpig or as a present-day estimate of malware infections.
The live connection was particularly valuable because it exposed current criminal activity rather than only old files. Brett Stone-Gross told Dark Reading: “Torpig provided a unique opportunity to understand a live botnet. Most of the time, researchers only gain access to offline data, [such as] through a dropzone server that may be years old, while the data that we received was in real-time.”
How the operators recovered control
- The operators changed the Torpig malware binary.
- The revised malware instructed infected computers to contact a new set of domains.
- Those domains were outside the researchers’ control, so subsequent C&C traffic no longer reached the UCSB infrastructure.
This response illustrates the limitation of domain registration as a takeover method: it can redirect clients only while the malware’s domain-generation behavior remains predictable and the researchers can register the relevant names first.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy publishing the findings caused controversy
The study offered defenders unusually detailed visibility into a functioning credential-theft operation. It also documented operational features that criminals could change once exposed. The debate was therefore about disclosure risk, not whether the researchers had permanently defeated Torpig.
Best Value
Sean Brady, then an RSA senior manager for identity protection and verification, warned in the contemporary report: “This [research] does create a road map…for the [botnet] criminals to fix, and not just for others to exploit.” The brackets and ellipsis are part of the quotation as printed by Dark Reading.
That tension is central to the episode: technical transparency can help researchers understand command-and-control systems and improve defenses, while the same detail can reveal weaknesses to the operators of an active botnet.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What “take over” means in this case
- It does mean: the UCSB team temporarily controlled the domains that selected infected machines were trying to reach and could observe their redirected communications.
- It does not mean: the team owned or seized the criminals’ servers, disinfected every victim, or ended Torpig permanently.
- It lasted: ten days in early 2009, until the operators updated the malware’s domain targets.
The episode is best understood as a short-lived research observation enabled by a weakness in Torpig’s domain-flux design, followed by an operator countermeasure.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What this historical case does—and does not—show
The case demonstrates how predictable domain-selection logic can expose a botnet’s communications to researchers who register the right names first. It also shows why control of redirected traffic is different from a takedown: the underlying infections and criminal infrastructure can continue operating after one communication path is lost.
The 2009 paper and contemporary reporting do not provide a current Torpig threat assessment, present-day cleanup instructions or evidence for a particular security product. Any claim about Torpig’s status today would require newer evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
