Dutch police have arrested two Dutch brothers suspected of running a botnet controlling 40,000 to 100,000 computers, with only a small portion (1,100 computers) based in the Netherlands.

The FBI has been investigating this case for a while before contacting the Dutch authorities. The arrests were made shortly after the two young bot-herders from the Frisian town of Sneek sold their network of compromised machines to a person in Brazil for €25,000 on Tuesday. The 35-year-old Brazilian man from Taubate (near Rio de Janeiro) has also been arrested and is awaiting extradition to the US.

The FBI hasn't revealed what the botnet was going to be used for, but Brazil along with Turkey and Russia hosts the highest number of zombies worldwide. Most botnets are exploited for denial-of-service attacks, click fraud, spamdexing and the theft of application serial numbers, login IDs, and financial information such as credit card numbers.

The younger 16-year-old brother has been released awaiting futher trial while the main suspect, 19, had to appear before a judge in Rotterdam on Friday.

In 2005 Dutch police arrested a trio of young men for creating a 1.5 million machine botnet, allegedly used to extort a US company and distribute spyware. ®

Related stories

• Neosploit hack-by-numbers kit euthanized (30 July 2008)
• DDoS attack floors Georgia prez website (21 July 2008)
• Built-in browser expiry proposed to fight botnet menace (3 July 2008)
• 19-year-old p2p botnet pioneer agrees to plead guilty (28 June 2008)
• Hacker cops to $70k botnet rampage (11 June 2008)