BLACK HAT USA – Las Vegas – Tom Grasso, unit chief of the FBI’s cyber division, took the Black Hat stage to discuss the processes and partnerships leading up to the massive Avalanche takedown in December 2016.

Avalanche “wasn’t a botnet,” he noted at the beginning of his talk. It was an infrastructure for enabling botnets, created by two administrators and active since 2010. The multitiered network of servers was used to spread malware campaigns, facilitate “money mule” laundering schemes, and act as a fast-flux communication infrastructure for other botnets.