Dutch Police and NCSC Operation Shuts Down A Botnet With 17M Devices

A significant success for Dutch law enforcement and cybersecurity authorities: Dutch Police and the National Cyber Security Centre (NCSC) have taken down a large botnet following a report from a security researcher. The investigation identified 200 servers located in the Netherlands that were used to support the network's infrastructure.

During the operation, police seized a number of the servers, after which the hosting provider shut down the entire infrastructure. According to the NCSC, the network was linked to at least 17 million infected devices and had been used to facilitate cyberattacks while concealing their origin.

The operation was announced jointly by the NCSC and Dutch Police on 28 May 2026. In related news, the NCSC's annual Cybercrime Monitor reported that cyberattacks against Dutch companies have fallen to their lowest level in the past nine years.

https://bit.ly/4uQXwq5

https://bit.ly/3RNjeN6

Keynotes:

"Dutch police say they dismantled a large botnet this week comprising at least 17 million infected devices."

"...police began an investigation, which resulted in the discovery of 200 servers underpinning the botnet's infrastructure located in the country."

"...NCSC-NL published its annual Cybercrime Monitor report, which revealed cyberattacks on Dutch companies had fallen to the lowest level in nine years."

IoT Security...

IoT devices are no more only targets of cyber attacks. They have evolved to an upper level where they can be used as a cyber attacking platform in DDoS attacks as Zombies.

As a normal but disturbing result because of these DDoS threats the importance of  the security of the IoT devices became an important issue. There are many ways to secure the IoT devices. Below there are some important actions to make the IoT devices more secure:

 

1) Do change the default passwords of your IoT devices.

 

2) One of the very basic and important security rule: Disable TELNET and HTTP access to your IoT devices. Use SSH and HTTPS instead of them.

 

3) If you don't need to connect your IoT devices remotely then DO disable remote access to your IoT devices. (Yes, disable even SSH and HTTPS.)

 

4) Put your IoT devices into another segment in your LAN and restrict accesses to your IoT devices with firewall rules or ACLs if possible.

 

5) Use WPA2 encryption for the wireless connection of your IoT devices. Try to not choose easily predictable passwords.

 

6) Expose your IoT devices to penetration tests. Let also your IoT devices be included in your penetration test scope. Do not neglect them.