Avast has an interesting article describing how they along with the Frensh police have taken over a botnet with some 850.000 PCs.
Retadup is a malicious worm affecting Windows machines throughout Latin America. Its objective is to achieve persistence on its victims’ computers, to spread itself far and wide and to install additional malware payloads on infected machines. In the vast majority of cases, the installed payload is a piece of malware mining cryptocurrency on the malware […]Source: Putting an end to Retadup: A malicious worm that infected hundreds of thousands - Avast Threat Labs