Microsoft and an international consortium of partners this week launched a counterstrike against Necurs, a massive botnet that Microsoft had been observing and analyzing for nearly eight years.

Botnets are packs of hundreds, thousands or millions of PCs, sometimes called zombies, that have been infected with malware and are under the command and control of malicious actors. Under-patched and out-of-support Windows 7 computer can be infected with a Trojan that enlists that computer in various nefarious schemes. The zombie PC’s owner may notice nothing at all, or sometimes suspect a decline in performance. According to Microsoft, Necurs has had a role in a lot of those nefarious schemes.

Believed to be controlled by criminals in Russia, the botnet is also thought to have been used directly by its owners, as well as rented out as a botnet-as-a-service fy. One of its highest-profile roles was aiding in distribution of the GameOver Zeus banking trojan.

In the years since it first came to the attention of security researchers in 2012, the network has infected as many as 9 million computers globally. It has left its nasty digital fingerprints on pump-and-dump stock scams, fake pharmaceutical spam, Russian dating scams, Internet-based computer attacks, credential theft schemes, data theft attempts, cryptomining and, of course, ransomware. While botnets can be a key component of distributed denial-of-service (DDoS) attacks and Necurs has DDoS capabilities, Microsoft says that particular use for the botnet has not been documented.

BitSight, a cyber risk management platform provider that worked closely with Microsoft on the Necurs problem. alleged “From 2016 to 2019, it was the most prominent method to deliver spam and malware by criminals and was responsible for 90% of the malware spread by email worldwide,”

Microsoft on March 5 got an order from the U.S. District Court for the Eastern District of New York to take over the systems inside the United States that are used by Necurs for malware distribution and computer infections.

Microsoft and its partners crafted a sophisticated response built on the technical specifics of the Necurs botnet. Having studied the algorithm that Necurs uses to generate new domains, Microsoft used its considerable technical resources to jump ahead of the botnet .e to accurately predict over six million unique domains that would be created in the next 25 months,”wrote Tom Burt, Microsoft corporate vice president for customer security and trust, in a blog post.

The main counterstrike was launched Tuesday from what a detailed New York Times account described as an “eerily empty Microsoft campus” due to most workers having been ordered home to prevent the spread of the coronavirus.

” “Microsoft is also taking the additional step of partnering with Internet Service Providers (ISPs) and others around the world to rid their customers’ computers of malware associated with the Necurs botnet.”

As a concrete step, Microsoft is pointing users to the Microsoft Safety Scanner to help wipe their computers of malware, including Necurs.

Microsoft executives were resigned that any drops in spam, malware and cyberattacks would be temporary at best. In the NYT article, executives described the effort — sadly and accurately — as a game of whack-a-mole.