Mobile Malware · Cutting Off Malware · Lesson 3 of 5

Takedowns & Sinkholes

How police and researchers cut malware off from its servers, and the limits.

The FluBot takedown

Detecting malware on one phone protects one person. A takedown goes after the infrastructure itself: the servers and domains that infected phones depend on. If the phones can't reach the attackers, stolen data stops flowing and new instructions stop arriving.

The best documented mobile example is FluBot, the parcel text malware from How Malware Gets In. On June 1, 2022, Europol announced that an operation involving law enforcement from 11 countries had disrupted it: Australia, Belgium, Finland, Hungary, Ireland, Romania, Spain, Sweden, Switzerland, the Netherlands and the United States. According to Europol, as reported by The Hacker News and Help Net Security, the Dutch police took control of FluBot's infrastructure in May 2022 and made the malware inactive.

Researchers saw the effect from outside. NCC Group reported that FluBot's servers went offline in late May 2022, and that the last new version they knew of appeared at the start of that month. Help Net Security reported the Dutch police as saying they had disconnected about ten thousand victims from the network and prevented more than 6.5 million spam texts.

A takedown has limits, and FluBot shows them:

• The malware stayed on phones. Cutting the connection made it inactive, but nobody removed it remotely. Europol's advice to victims was still a factory reset, restoring only from a backup made before the infection, and checking bank accounts and passwords.
• The people weren't caught. Europol said the investigation was continuing in an effort to identify the individuals behind the campaign.
• Rebuilding is possible. NCC Group noted that operators can register new domains and move to new hosting, so it was too early to call FluBot gone for good.

Takedowns still matter. They stop an active wave, cut off fresh data theft, give investigators evidence, and force the operators to start over with new infrastructure and new victims. Researchers often track a family for months afterward to see whether it returns.

Sinkholes, and reading their numbers

A sinkhole takes over the address malware tries to reach. When defenders gain control of a malicious domain, through a court order, the domain's registrar, or national law, they point it at a server they run. Infected devices keep trying to connect, but they arrive at the sinkhole, which records the visit and sends nothing harmful back.

That does two jobs. It cuts devices off from the attackers, and it shows defenders who is infected, because every device that checks in reveals its IP address.

On December 12, 2024, Germany's Federal Office for Information Security (BSI) announced it was sinkholing BadBox, malware found on cheap Android based devices. BSI said up to 30,000 devices in Germany were affected, mainly digital picture frames and media players, and that in every case it knew of, the malware was already on the device when it was bought. Under German law, internet providers with more than 100,000 customers redirected the malware's traffic. BSI told owners of affected devices to disconnect them from the internet.

The security firm BitSight sinkholed a BadBox domain too. As reported by BleepingComputer, it registered more than 160,000 unique IP addresses in a 24 hour period, and the article described about 192,000 infected devices worldwide, many of them smart TVs. Read numbers like these carefully. IP counts aren't device counts. Several devices behind one home router share a public IP (remember NAT & Your Public IP), and one device can appear from several IPs as it changes networks or its provider reassigns addresses.

Sinkholes share the limits of takedowns. The malware stays on the device. The operators can move to domains defenders don't control. And for malware that ships preinstalled, like BadBox, the real fix is replacing the device or getting clean software from a trustworthy maker, which most owners can't arrange themselves.

Still, a sinkhole turns the malware's own habit of checking in into a census of victims, which lets providers warn the people affected.