The Retadup malware which was used to infect thousands of computers mines cryptocurrency by draining the computer’s power from it processor. The malware was used to only generate cash but could have also been used as a spyware or even a ransomware.
Avast and the French police carried out the operation by secretly and quietly obtaining screenshots of the malware’s command and control server, they did this by working hand in hand with the web host of the server.
All they needed was just a copy of the command and control server to build their own clone which would disinfect already infected computers.(classic takedown)
After all that was done, the security firm succeeded in stopping and removing over 850,000 malicious code from infected computers.