# Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C Domains Surge +771%

> Spamhaus's January-June 2026 botnet threat update reports observed botnet C&C servers fell 30% to 14,952 while the open-source Sliver C2 framework rose 58% (1,904 to 3,008 detections) to overtake Cobalt Strike, which fell 68% (3,451 to 1,110) and dropped from #1 to #4 - its largest recorded decline. .cn C&C domains surged 771% and India's PDR registrar saw a 901% spike in abused registrations, while REGRU cut abuse by 90%.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2469
- **ID:** TL-2026-2469
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Spamhaus Project's semi-annual Botnet Threat Update for January-June 2026 documents a structural shift in the command-and-control (C2) tooling landscape tracked across its botnet C&C corpus. Total observed botnet C&C servers fell 30% period-over-period to 14,952, yet Spamhaus separately notes overall botnet C&C activity rose 24% in the same window - the two figures together indicating a smaller but more active tracked infrastructure base rather than a genuine decline in botnet operations. This 24% rise continues a trend from the immediately preceding period: Spamhaus's 'Botnet Threat Update July to December 2025' (published 2026-01-12) already reported a 24% period-over-period C&C activity increase, and Spamhaus's CERT Insight Portal materials separately state botnet C&C activity detected by Spamhaus rose 56% across calendar year 2025.

The headline finding is a leadership change among adversary C2 frameworks. Sliver, the open-source, cross-platform Golang C2 framework originally built by Bishop Fox as a red-team tool (MITRE ATT&CK Software S0633) and now widely abused by financially motivated and espionage threat actors as a Cobalt Strike alternative, climbed from 1,904 to 3,008 detections (+58%) to take the #1 spot. Cobalt Strike (MITRE ATT&CK Software S0154) - long the dominant commercial red-team-tool-turned-adversary-C2 framework - fell from 3,451 to 1,110 detections (-68%), dropping from #1 to #4. Spamhaus states this is Cobalt Strike's largest percentage decline since it began tracking the framework, consistent with a broader industry pattern of licensing crackdowns, cracked-license takedown pressure, and improved signature-based detection pushing adversaries toward Sliver and other emerging frameworks. Spamhaus's Top 20 botnet-associated malware list is now 42% Remote Access Trojans (RATs) by family count (unchanged from the July-December 2025 period), underscoring that C2-framework and RAT tradecraft together dominate the tracked botnet corpus.

MITRE ATT&CK's own Sliver (S0633) software page - cited directly as a primary technical source for this record - documents the specific tradecraft driving Sliver's detection-engineering relevance: built-in UAC-bypass and access-token-manipulation capabilities for privilege escalation; PowerShell command execution; Wireguard, HTTP(S), and DNS-based C2 channels; AES-GCM-256 symmetric and mutual-TLS/RSA asymmetric encrypted channels; Go-native obfuscation via the garble and gobfuscate libraries; a built-in SOCKS5 internal proxy; a procdump command for LSASS credential dumping; and incorporation of the Rubeus toolkit for forging Kerberos Golden Tickets. MITRE documents APT29 (G0016), Cinnamon Tempest (G1021), and TA551 (G0127) as threat groups that have used Sliver - concrete evidence that Sliver's H1 2026 detection surge reflects genuine, diverse adversary adoption rather than isolated red-team noise.

The report also documents a sharp shift in the domain-registration infrastructure adversaries use to stand up C2: .cn (China) botnet C&C domain registrations surged 771%, and India-based registrar PDR (Publicdomainregistry.com) saw abused registrations spike 901%. In contrast, Russian registrar REGRU cut abuse by 90%, which Spamhaus frames as a positive counter-trend against otherwise rising registrar abuse - notably, a different Russia-based registrar had recorded a +9,608% surge in abused botnet C&C domains in the immediately preceding July-December 2025 period, underscoring how registrar-level abuse patterns can swing sharply between consecutive reporting periods. These figures describe where and through whom adversaries are acquiring C2 domain infrastructure (MITRE ATT&CK Resource Development), not a specific victim campaign, and Spamhaus does not attribute the trend to a single threat actor or campaign.

Alongside the update, Spamhaus references its CERT Insight Portal - a free tool for government-funded national/regional CERTs and CSIRTs (over 100 of which already rely on Spamhaus data for remediation, per Spamhaus) - that layers enriched IP/ASN/malware/country metadata atop three underlying Spamhaus data sources: the Botnet Controller List (BCL), the Spamhaus Blocklist (SBL), and the Exploits Blocklist (XBL, which detects malware-infected hosts and underpins the portal's 'Bot Report'). The portal's separate 'Botnet C&C Report' cross-references detected botnet C&C servers against Malpedia, the Fraunhofer FKIE malware-family reference database, for family-level correspondence. This tooling is part of a broader push - alongside network operators and law enforcement - to target bulletproof hosting providers and the IP brokers/network carriers/datacenters that sustain them.

No CVE, specific network IOC list (IPs/domains/hashes), or single-campaign threat-actor attribution is stated in the primary H1 2026 source; this record documents the tracked framework/infrastructure-abuse statistics, their MITRE ATT&CK-documented technical basis, and their detection-engineering implications rather than fabricating attribution or indicators the source does not provide.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.005 Botnet
- T1059.001 PowerShell
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.004 DNS
- T1090.001 Internal Proxy
- T1090.004 Domain Fronting
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1548.002 Bypass User Account Control
- T1134 Access Token Manipulation
- T1003.001 LSASS Memory
- T1558.001 Golden Ticket

## Sources

- [Botnet C&C | Botnet Threat Update January to June 2026 | Report](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2026)
- [Botnet Threat Update January to June 2026 - Security Boulevard](https://securityboulevard.com/2026/07/botnet-threat-update-january-to-june-2026/)
- [Botnet Threat Update January to June 2026 | daily.dev](https://daily.dev/posts/botnet-threat-update-january-to-june-2026-3kxgfsujh)
- [NEW: Spamhaus CERT Insight Portal - Enhanced Botnet C&C Intelligence](https://www.spamhaus.org/resource-hub/botnet-c-c/spamhaus-cert-insight-portal-enhanced-botnet-c-and-c-intelligence/)
- [Botnet Spotlight | Networks Hosting Botnet C&Cs: Same Players, Same Problems](https://www.spamhaus.org/resource-hub/botnet-c-c/networks-hosting-botnet-ccs/)
- [Botnet C&C | Botnet Threat Update July to December 2025 | Report](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/)
- [Sliver, Software S0633 | MITRE ATT&CK](https://attack.mitre.org/software/S0633/)
- [Cobalt Strike, Software S0154 | MITRE ATT&CK](https://attack.mitre.org/software/S0154/)
- [Acquire Infrastructure, Technique T1583 | MITRE ATT&CK](https://attack.mitre.org/techniques/T1583/)
- [Sliver (win.sliver) Malware Family | Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2469