Six months after a major law-enforcement crackdown, DanaBot is back with a rebuilt Tor-based infrastructure and a new variant targeting Windows users. For defenders, it’s a blunt reminder that takedowns without arrests don’t end threats—they reset the clock.