The servers were infected with malware known as Mumblehard which ESET researchers discovered and issued details about a year ago.

In a blog post, ESET said it had taken down the botnet in co-operation with the Cyber Police of Ukraine and Cys Centrum LLC on February 29.

The company is now operating a sinkhole for Mumblehard components and sharing the data with the Computer Emergency Readiness Team in Germany which is notifying affected parties through their national CERTs.

After the initial analysis was published last year, ESET said it noticed that the operators of the botnet had taken down all the command and control servers, apart from one that was directly under their control.

With only one IP address in play, ESET decided to notify the authorities in the country of operation and take over the IP address. Analysing information obtained from the command and control server in October last year, ESET researchers were able to determine that the various bots had been infected using vulnerabilities in PHP.

The researchers also discovered that there was code in the command and control server that requested automatic delisting whenever one of the bots got listed in the Spamhaus Composite Blocking list. This is a list that serves to block servers that are sending out spam.

There were victims in 63 countries, ESET reported. The command and control server was shut down on February 29 by Ukrainian authorities and replaced with a server under the control of ESET. Data collected throughout March showed that at least 4000 Linux systems had been compromised.

According to the researchers, Mumblehard had been active since at least 2009. Other findings were that the Perl scripts used were packed inside ELF binaries written in assembly language, showing a higher level of sophistication than is usual among the creators of similar malware.

A total of 8867 unique IP addresses were seen in the ESET sinkhole over a seven-month period, with the highest number of unique IP addresses in a day being 3292.

The research also found that web servers were the most susceptible to being infected and that there was a link between Mumblehard and Yellsoft, an online company selling software for sending bulk email messages.