---
title: "Mild-Mannered Botnet Hunts Down Malware so It Can Fix It"
description: "A security firm has identified a sort of fairy godmother botnet that looks for a specific malware infection and cures it — before politely deleting itself."
date: "2018-09-18"
modified: "2018-09-19"
authors:
  - name: "Jon Christian"
    job_title: "Executive Editor"
    link: "https://futurism.com/authors/jonc"
url: "https://futurism.com/the-byte/good-guy-botnet-hunts-malware"
categories:
  - "Artificial Intelligence"
tags:
  - "com.ufo.miner"
  - "fbot"
  - "hacking"
  - "malware"
  - "netlab 360"
  - "the digest"
---

# Mild-Mannered Botnet Hunts Down Malware so It Can Fix It

![](<https://futurism.com/wp-content/uploads/2018/09/botnet-crypto-malware.png>)
*\<em\>Image: Victor Tangermann\</em\>*

## MALWARE HUNTER

If you're unfortunate enough to visit a malicious page or click the wrong thing in a phishing email, you might catch a botnet — malware that hijacks your computer in order to perform a nefarious deed, like attacking a site, spreading a virus, or mining cryptocurrency.

But now, network security firm Netlab 360 [says it's identified](<https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/>) a guardian angel botnet which, instead of harming your computer, looks for a specific malware infection and cures it before politely deleting itself.

## SEARCH AND DESTROY

We don't know who created the malware, which Netlab 360 engineer Hui Wang dubbed "Fbot." But it seems to have just one mission: get rid of one specific kind of malware.

Fbot first infects computers that leave a specific port vulnerable to attack. Then it searches its new hosts for a piece of malware called com.ufo.miner, which uses infected computers to mine the cryptocurrency Monero — and eradicates it.

"\[S\]o far," Wang wrote in the blog post, "the only purpose of this botnet looks to be just going after and removing another botnet."

## CHAOTIC GOOD?

It's not clear, *CoinDesk* [pointed out](<https://www.coindesk.com/novel-botnet-hunts-down-and-destroys-crypto-mining-malware/>), whether Fbot is the creation of an anonymous do-gooder or a rival hacker.

But it does provide a glimpse of an intriguing future in which autonomous agents roam the web like bounty hunters.

**READ MORE:** [Fbot, A Satori Related Botnet Using Block-chain DNS System](<https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/>) \[*Netlab 360*\]

***More on botnets: [Researchers Inadvertently Discover Crypto Scam Involving 15,000 Twitter Bots](<https://futurism.com/the-byte/crypto-scam-twitter-bots>)***

## Author
I'm responsible for editing, assigning, and scouting at Futurism, as well as occasionally writing for the site. That work involves keeping an eye on a wide range of narratives and issues, but over the past few years I've become increasingly interested in how AI is shaping the future of media, the web, and information itself. My day-to-day often involves collaborating on reporting and commentary projects bylined by my colleagues, but I try to find time to do my own reporting as well; stories I've broken for Futurism have been cited by publications including the New York Times, the Washington Post, the New Yorker, Wired, Ars Technica, New York Magazine, the Columbia Journalism Review, Bloomberg, and more. I grew up in Southern Vermont and attended Vanderbilt University. Prior to Futurism, I contributed to outlets including the Boston Globe, Vice, Wired, Slate, the Atlantic, the Outline, Ars Technica and more, and did stints in farming and food service. I currently live in Brooklyn, New York, and in my free time I enjoy pinball, word games, cycling, running, and music production.

### Author social links  
[Bluesky](<https://bsky.app/profile/jonchristian.net>)