The group had been going strong for at least five months with the TK Worm project. Special compromised computers had been programmed to run IRC servers , scripts written to control entire botnets of 10,000+ machines, and an auto-run virus feature to automatically spread to infect more machines. Time for fun had begun.
At any given time, the servers held at least 8,000 bots. Some were public servers, some were private corporations, and there were even a few military servers. The infected hosts had many functions. The faster botsthose that could send data at speeds upwards of 5,000 Kbps (5 MB/second) were used as warez dumps. Those that had good uptime, upwards of four weeks, were turned into IRC servers to keep the network stable. The midrange machines were used for anything from IRC XDCC bots to funny psyBNCs. (Nothing like having your hostname show up as firstname.lastname@example.org.) The majority, about 95%, were simply used for DDoS attacks.