My favourite story of this is that ransomware virus that was taking out places like the NHS, and some security researcher noticed it kept pinging some domain that was a random bunch of characters.

He registered the domain, and suddenly the ransomware shut down, freeing all the places the ransomware had infected.

It turns out when researching a virus the environments commonly treat all domains as valid so they can capture the traffic and see what the virus is doing. To prevent this, the ransomware was designed to shut down if this clearly fake domain came back as valid (and I guess this was the release switch if the ransom was paid). That was it would shut down if in this kind of a sandboxed environment.

The story is here, written by the researcher so it's a bit technical. There were lots of news stories about it at the time too.