"We knew in advance what were the sequence of addresses they would visit so we just waited," says Giovanni Vigna, the UC Santa Barbara computer science professor who teamed with staff and graduate students to bust into Torpig.

Last month they published the eye-popping account of what happened in the 10 days before they were dropped from Torpig, apparently because its operators discovered the infiltration.

The report, "Your Botnet is My Botnet: Analysis of a Botnet Takeover," details how the Torpig botnet was seen to have made more than 180,000 infections on victim's machines and recorded 70GB of data collected by the bots in just 10 days.

Torpig obtained the credentials of 8,310 accounts at 410 different institutions. The top targeted were PayPal, Poste Italiane, Capital One, E*Trade and Chase. About 38% of the credentials stolen by Torpig were obtained from the password manager of browsers, rather than by intercepting an actual log-in session, according to the report. Torpig also collected 1,660 unique credit and debit cards, prominently Visa, MasterCard and American Express, with 49% of the victims thought to be in the United States.  Torpig in those 10 days was seen to grab 297,962 unique credentials from 52,540 different Torpig-infected machines, with the top Web account credentials identified for Google, Facebook, MySpace, netlog.com, libero.IT, Yahoo, nasza-klasa.pl, alice.it, live.com and hi5.com.

The UC Santa Barbara researchers also observed traffic that suggested individuals thought infections were cleaned up when they weren't.

The main means of infection with Torpig comes from drive-by downloads from legitimate Web sites that have become compromised with malware by attackers, or occasionally attack sites set up for the purpose.

The effect of the drive-by download is "it modifies your browser so it becomes different," Vigna says. When you next visit your banking Web site, the Torpig-infected desktop displays a fake Web page that tricks the victim into entering his banking password and log-in, for example. Torpig then has it and sends it off to the Torpig operators.

The UC Santa Barbara researchers suspect Torpig is a "malware service" accessible to third parties for a fee.

Vigna says the researchers never discovered who runs Torpig, but did share data with the FBI. UC Santa Barbara was assisted in the Torpig infiltration project by funding from the National Science Foundation, which is supporting a  five-year effort to explore the underground economy.

The Torpig botnet suggests a pattern of cooperation between attackers compromising Web sites with malware that directly helps those operating Torpig gain more victims, and it's a trend that likely extends beyond Torpig.