Usually botnet control systems like this will generate a new domain every day using some difficult-to-predict algorithm. Maybe seed it off of the previous day

Usually botnet control systems like this will generate a new domain every day using some difficult-to-predict algorithm. Maybe seed it off of the previous day Dow Jones Index closing figure or something. This makes it a race to try to register the domain before the bad guys do. I find it weird how all of the stories about this thing have the tone of "oh no, what could it be for, there is no payload!?!", when it phones home to a control server regularly waiting for payload. Guys, it's a botnet. They're just waiting for it to get big enough to be worth selling. This isn't some huge mystery. It could be used for hundreds of uses from DDOSing, to spamming, to being a covert VPN network, to Warez distribution, porn, etc... Plus it will probably eventually install a keylogger on the system to harvest CC numbers and passwords from the infected users, maybe run some crypto-locking ransomware if the devs need some bitcoin. All of the typical stuff you can expect after a box is rooted by one of these botnet operators.