The Miracle of the Halted Avalanche

The wonder

On 30 November 2016, after four years of investigation, a coordinated action in 30 countries dismantled Avalanche, a "bulletproof" infrastructure that had served more than 20 malware families. More than 800,000 domains were seized, sinkholed or blocked, five people were arrested and 39 servers seized. It was one of the largest operations ever mounted against cybercrime infrastructure.

The miracle worker

The Lüneburg police and Verden prosecutors, who led the investigation, with the FBI, Europol, Eurojust, the Shadowserver Foundation and law-enforcement agencies and registries in dozens of countries.

Thanksgiving

For eight hundred thousand domains silenced in one night, and for the patience of those who investigated for four years, we give thanks. Amen.

Technical record

After four years of investigation led by German police and prosecutors with the FBI, Europol and Eurojust, a coordinated action across 30 countries seized, sinkholed or blocked over 800,000 domains. The operation shut down Avalanche, a bulletproof infrastructure that had served more than 20 malware families. Five people were arrested and 39 servers seized.