Share this article
Crypto-Jacking Virus Infects 850,000 Servers, Hackers Run off With Millions
French cybersecurity, officials dubbed 'cyber gendarmes,' announced the disabling of an 850,000 server botnet operating mostly in Latin America.
Updated Sep 13, 2021, 11:23 a.m. Published Aug 28, 2019, 6:00 p.m.
French authorities shut down a botnet army responsible for crypto-jacking thousands of computers across 140 countries.
Yesterday, French cybersecurity, officials dubbed "cyber gendarmes," announced the disabling of a botnet force 850,000 servers strong operating mostly in Latin America. The botnet head was located in France and was inoculating computers with monero crypto-jacking software, according to a BBC report.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
A malicious form of computer predation, crypto-jacking involves remotely and secretly installing crypto mining software onto computers. Infected computers bare electrical and maintenance costs while hackers walk away with the crypto.
The virus was first spotted by private firm Avast in the spring. An email promising money or erotic images linked to the virus and in certain cases infected USB drives also carried the virus.
While the number of machines infected is known, the amount stolen is not. Official estimates run into the millions of euros with the culprits still on the run.
French officials tracked the head pirate server to Île-de-France. The server has been in operation since 2016, utilizing the Retadup virus to crypto jack computers along with stealing personal data from Israeli hospitals, among other nefarious acts.
Over the next six months, French officials shut down the server while moving the virus to unused parts of the web.
“Basically, we managed to detect where was the command server, the control tower of the network of infected computers, the 'botnet,’” said Jean-Dominique Nollet to France Inter Radio, head of the Center for Combating Digital Crime (C3N). “It was copied, replicated with a server of ours, and made to do things that allow the virus to be idle on the victims' computers,” he continued.
While a large achievement for the French authorities, Nollet warned rebooting the hack was nearly as easy as a copy and paste command. “Unfortunately we know they can recreate this kind of hacker server at any time,” he said.
Earlier this month, data analysis company Carbon Black released a study on another monero botnet force, infecting some 500,000 servers, operating across eastern Europe and parts of Asia.
Glass image via Shutterstock
More For You
What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Strive Starts $500M Preferred Stock "At-The-Money" Program for Bitcoin Purchases
The new preferred stock offering, SATA, strengthens Strive’s capital options as it expands its bitcoin focused strategy.
What to know:
- Strive announced a $500 million at-the-market offering to fund further bitcoin purchases.
- SATA, the company's preferred stock, offers a 12% dividend and trades below its $100 par value.
- Proceeds from the offering may also be used for buying income-generating assets or company acquisitions.
Top Stories
