The attack has to find the control nodes. Domains and IP addresses can be turned off. With this approach, there's no way to stop the finding process even after the attack has been reverse-engineered, short of firewalling or shutting down crypto nodes.

What happens when Ethereum gets a takedown order?

More generally, what happens as the malware ecosystem integrates with the cryptocurrency ecosystem?