An international public-private operation in 2026 disrupted infrastructure associated with the Sality botnet, which Europol said had been active for two decades.
Investigators associated the operation with more than 11 million unique infected IP addresses.
The figure illustrates one of the defining characteristics of botnets: scale.
A botnet is not necessarily one dramatic infection. It can be a large collection of compromised devices that criminals use for malicious purposes.
For ordinary users, the best protection remains boring but effective: install updates, use reputable security software, avoid pirated software and do not ignore unusual device behaviour.
Old malware infrastructure can remain relevant for years because vulnerable devices remain online.
Security therefore has to be maintained continuously.