Operation Bot Roast and the takedown trajectory
The FBI announced Operation Bot Roast in mid-June. The takedown trajectory matters more than the specific operation; specific structural lessons inform the DDoS book.
Mytob and the merged worm-bot trajectory
Mytob variants have proliferated through 2005, merging mass-mailing worm propagation with IRC-bot command-and-control. The hybrid is structurally important.
Phatbot and the modular-bot trajectory
Phatbot/Agobot is currently the most visible IRC-controlled bot family. The source has been semi-public for some time; new variants appear weekly; the architecture is structurally important.