ALT An Update on Industrialize the Tracking of Botnet Operations – A Practical Case with Large Coin-Mining Threat-Actor(s) Alexandre Dulaunoy, Jean-Louis Huynen CSIRTs/CERTS, like CIRCL, are regularly tracking, monitoring and disturbing botnet networks. This can be a tedious task for incident responders. We will release the threat intelligence related to a large coin-mining threat-actor(s) during this talk. Excel sheets don’t scale any more and this case showed us when to automate and where the benefit from proper tooling is a gain for a team. We will also propose some techniques for continuous monitoring of threat actors.