Bitcoin Forum

It is not the first time a ransomware C&C server is breached, as a similar report surfaced a few months ago. That particular attack saw a white hat hacker infiltrate a Dridex banking malware C&C server, bringing the distribution through that platform to a halt. In fact, the infiltrator updated most of the malicious links with urls to Avira antivirus web installers.

http://themerkle.com/security-experts-infiltrate-locky-ransomware-cc-server/