@imaguid @spiresec yes and how many machines were infected? also, this was actually by vuln. Didn't DNSChanger require user action? SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique