> Infected machines will regularly check-in. These methods rely on domains and static IP addresses. Predictably these domains and IP addresses get identified, burned, and/or seized.

Instead of seizing and shutting down the command and control system, why not let it run for awhile and secretly monitor who connects to it? Are the malware operators always connecting to the command and control system via Tor or equivalent? They never slip up? I find it amazing that these huge malware operators are so rarely tracked down.