Dutch Botnet Bigger Than Expected

Dutch prosecutors who last month arrested a trio of young men for creating a large botnet allegedly used to extort a U.S. company, steal identities, and distribute spyware now say they bagged bigger prey: a botnet of 1.5 million machines.

According to Wim de Bruin, a spokesman for the Public Prosecution Service (Openbaar Ministerie, or OM), when investigators at GOVCERT.NL, the Netherlands' Computer Emergency Response Team, and several Internet service providers began dismantling the botnet, they discovered it consisted of about 1.5 million compromised computers, 15 times the 100,000 PCs first thought.

The three suspects, ages 19, 22, and 27, were arrested Oct. 6 on charges of threatening a U.S. firm with a denial-of-service (DoS) attack after Amsterdam-based Internet service provider XS4ALL notified authorities of unusual activity on its network. The two younger men are still in custody -- a Breda court just extended their incarceration by 30 days -- but the 27-year-old has been released pending trial, said the OM.

More arrests are likely, de Bruin said, as the investigation continues.

The trio supposedly used the Toxbot Trojan horse to infect the vast number of machines, easily the largest controlled by arrested attackers. But Simon Hania, chief technology officer at XS4ALL, told the Associated Press that even though the botnet was enormous, it was just "a drop in the ocean."

"[These things] destroy the Internet," he said.