Skip to content
Microsoft and BitSight Disrupt Necurs Botnet Operations

Microsoft and BitSight Disrupt Necurs Botnet Operations

First seen 31 Oct 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 18:13 UTC
  • •Microsoft led a takedown of the Necurs botnet, affecting over 9 million systems.
  • •The botnet was responsible for 90% of email malware spread from 2016 to 2019.
  • •BitSight collaborated with Microsoft since 2017 to analyze and disrupt Necurs operations.

Microsoft, in collaboration with BitSight, announced a successful takedown of the Necurs botnet, which has been active since 2012 and infected over 9 million computers worldwide. The operation, which took place on March 5, 2026, involved legal and technical measures to disrupt the botnet's infrastructure. The U.S. District Court for the Eastern District of New York authorized Microsoft to take control of U.S.-based infrastructure used by Necurs for malware distribution. The botnet was primarily used for spam, ransomware delivery, and financial malware, accounting for 90% of email malware spread from 2016 to 2019. BitSight has been analyzing Necurs since 2016 and worked with Microsoft to understand its operations and mitigate its impact. The botnet's activity had stalled since 2019, leaving an estimated 2 million systems in a dormant state. The current status includes efforts to prevent the registration of new domains by the criminals behind Necurs.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-05
U.S. Court authorized takedown of Necurs
The U.S. District Court allowed Microsoft to take control of infrastructure used by Necurs for malware distribution.
Techtarget
2026-10-31
Microsoft announces successful takedown
Microsoft and BitSight confirmed the disruption of Necurs botnet operations, affecting millions of systems.
www.bitsight.com

More articles in this cluster (3)

Following this threat?

Track Necurs in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

What is the current status of the Necurs botnet?
The Necurs botnet has been disrupted, with ongoing efforts to prevent new domain registrations by its operators.
How many systems were affected by Necurs?
Necurs is believed to have infected over 9 million computers globally.
What types of malware did Necurs distribute?
Necurs was primarily used to distribute ransomware, financial malware, and spam, including pump-and-dump stock scams.