Interesting article on a group of researchers at UCSB and how they intercepted the movements of the Torpig botnet. Theres also a 1 hour video lecture on how they actually did it.
http://www.catonmat.net/blog/how-to-steal-a-botnet-video-lecture-review/
http://www.catonmat.net/blog/how-to-steal-a-botnet-video-lecture-review/