Crypto-Jacking Virus Infects 850,000 Servers, Hackers Run off With Millions

French cybersecurity, officials dubbed 'cyber gendarmes,' announced the disabling of an 850,000 server botnet operating mostly in Latin America.

AccessTimeIconAug 28, 2019 at 6:00 p.m. UTC
Updated Sep 13, 2021 at 11:23 a.m. UTC

French authorities shut down a botnet army responsible for crypto-jacking thousands of computers across 140 countries.

Yesterday, French cybersecurity, officials dubbed "cyber gendarmes," announced the disabling of a botnet force 850,000 servers strong operating mostly in Latin America. The botnet head was located in France and was inoculating computers with monero crypto-jacking software, according to a BBC report.

A malicious form of computer predation, crypto-jacking involves remotely and secretly installing crypto mining software onto computers. Infected computers bare electrical and maintenance costs while hackers walk away with the crypto.

The virus was first spotted by private firm Avast in the spring. An email promising money or erotic images linked to the virus and in certain cases infected USB drives also carried the virus.

While the number of machines infected is known, the amount stolen is not. Official estimates run into the millions of euros with the culprits still on the run.

French officials tracked the head pirate server to Île-de-France. The server has been in operation since 2016, utilizing the Retadup virus to crypto jack computers along with stealing personal data from Israeli hospitals, among other nefarious acts.

Over the next six months, French officials shut down the server while moving the virus to unused parts of the web.

“Basically, we managed to detect where was the command server, the control tower of the network of infected computers, the 'botnet,’” said Jean-Dominique Nollet to France Inter Radio, head of the Center for Combating Digital Crime (C3N). “It was copied, replicated with a server of ours, and made to do things that allow the virus to be idle on the victims' computers,” he continued.

While a large achievement for the French authorities, Nollet warned rebooting the hack was nearly as easy as a copy and paste command. “Unfortunately we know they can recreate this kind of hacker server at any time,” he said.

Earlier this month, data analysis company Carbon Black released a study on another monero botnet force, infecting some 500,000 servers, operating across eastern Europe and parts of Asia.

Glass image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Read more about