At one point, Avalanche network was responsible for two-thirds of all phishing attacks.

[Update, 3:00 PM EDT: This story has been updated with additional details from The Shadowserver Foundation and Europol.]

A botnet that has served up phishing attacks and at least 17 different malware families to victims for much of this decade has been taken down in a coordinated effort by an international group of law enforcement agencies and security firms. Law enforcement officials seized command and control servers and took control of more than 800,000 Internet domains used by the botnet, dubbed "Avalanche," which has been in operation in some form since at least late 2009.

"The operation involves arrests and searches in five countries," representatives of the FBI and US Department of Justice said in a joint statement issued today. "More than 50 Avalanche servers worldwide were taken offline."

A Europol release on the operation provided more details, stating:

[Five] individuals were arrested, 37 premises were searched, and 39 servers were seized. Victims of malware infections were identified in over 180 countries. Also, 221 servers were put offline through abuse notifications sent to the hosting providers. The operation marks the largest-ever use of sinkholing to combat botnet infrastructures and is unprecedented in its scale, with over 800 000 domains seized, sinkholed or blocked.

The domains seized have been "sinkholed" to terminate the operation of the botnet, which is estimated to have spanned over hundreds of thousands of compromised computers around the world. The Justice Department's Office for the Western Federal District of Pennsylvania and the FBI's Pittsburgh office led the US portion of the takedown. "The monetary losses associated with malware attacks conducted over the Avalanche network are estimated to be in the hundreds of millions of dollars worldwide, although exact calculations are difficult due to the high number of malware families present on the network," the FBI and DOJ said in their joint statement.

In 2010, an Anti-Phishing Working Group report called out Avalanche as "the world’s most prolific phishing gang," noting that the Avalanche botnet was responsible for two-thirds of all phishing attacks recorded in the second half of 2009 (84,250 out of 126,697). "During that time, it targeted more than 40 major financial institutions, online services, and job search providers," APWG reported. In December of 2009, the network used 959 distinct domains for its phishing campaigns. Avalanche also actively spread the Zeus financial fraud botnet at the time.

The phishing messages sent through Avalanche's army of bots in 2009 were generally spoofed e-mails from financial institutions, including USAA (a bank largely serving US military and veterans) and HSBC. The botnet churned through domains faster than most, with more than half its domains being live for less than 12 hours in late 2009. The programmatic churning through domains is how the botnet accrued more than 800,000 domains by the time of the takedown this week.

The Shadowserver Foundation, a non-profit organization of security professionals that assisted in what the organization described in a post on the takedown as an 18-month collaboration with law enforcement, described Avalanche as a "Double Fast Flux" botnet. Individual nodes within the botnet are registered and then quickly de-registered as the host associated with a Domain Name Service A address record for a single DNS name The destination addresses for a DNS record often change as quickly as once every 5 minutes, and can cycle through hundreds or thousands of IP addresses. And there are multiple domain names for command and control nodes hard-coded into the botnet malware, allowing the bots to switch to a different domain name if a specific domain is blocked. "More than 20 different malware families using multiple Domain Generation Algorithms (DGAs) and operating criminal infrastructure in 30 countries and US states impacted over 60 registries worldwide required unprecedented levels of effective international partnership," a Shadowserver Foundation spokesperson reported.

Avalanche's phishing operations appeared to drop off in 2010—likely because the organization behind the botnet turned to other sources of income, using its infrastructure to spread a variety of malware instead. By 2012, Avalanche's command and control network was pushing a variety of crimeware, including "police ransomware." That malware spoofed a message from law enforcement claiming the victim's system had been distributing illegal pornography, then disabling the infected computer until the victim paid a "fine" to unlock it. According to Symantec, the same block of command and control servers was also used by a banking Trojan called Bebloh that targeted German speakers. This malware family was investigated at the time by police in Luneburg, Germany, and as the investigation expanded, more and more malware families were discovered to be tied to the same command and control infrastructure.

As the investigation grew, the Luneburg police and the public prosecutor's office for the district of Verden, Germany were joined by law enforcement organizations from more than 40 countries, including the FBI's Pittsburgh Division and the Computer Crime and Intellectual Property Section of the United States Department of Justice, Europol, and Eurojust.

The Justice Department said additional information on the dismantling of Avalanche—and information about some of its victims in the Pittsburgh area—will be provided "early next week."