Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C Family

Key facts for Sliver botnet C2 trends

Detection coverage for Sliver botnet C2 trends

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5111 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Sliver and Cobalt Strike Tooling Execution on Endpoints (TL-2026-5111)

Behaviour-first detection for execution of Sliver (MITRE S0633) and Cobalt Strike (S0154) tooling: Sliver server/client binaries and implant-generation command lines (generate --mtls/--http/--dns/--wg, implants new, armory install), plus Cobalt Strike beacon/artifact binaries, rundll32 StartW DLL beacon launches and download-cradle stagers using default profile URIs. Spamhaus H1 2026 data (TL-2026-5111) shows Sliver is now the #1 botnet C&C family (3,008 detections, +58%) while Cobalt Strike fell to #4 (1,110, -68%), so content must cover both. Maps to T1059, T1219 and T1588.002.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1219, T1588.002
• Data sources: sysmon, microsoft_defender_xdr
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
| eval sliver=if(match(img,"(^|[^a-z0-9])sliver[a-z0-9._-]*$") OR match(cmd,"sliver-(client|server)|implants\\s+(new|generate)|generate\\s+(beacon\\s+)?--(mtls|http|https|dns|wg)|armory\\s+install"),1,0)
| eval cobalt_strike=if(match(img,"(beacon|artifact[0-9]*)\\.(exe|dll)$") OR match(cmd,"rundll32(\\.exe)?\\S*\\s+\\S+\\.dll\\S*,\\s*startw|downloadstring.{0,80}(__utm\\.gif|pixel\\.gif|dpixel)"),1,0)
| where sliver=1 OR cobalt_strike=1
| eval family=case(sliver=1 AND cobalt_strike=1,"Sliver + Cobalt Strike",sliver=1,"Sliver",true(),"Cobalt Strike")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_images values(CommandLine) as command_lines by host User Image family
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User family Image parent_images command_lines count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName has "sliver"
    or ProcessCommandLine matches regex @"(?i)sliver-(client|server)|implants\s+(new|generate)|generate\s+(beacon\s+)?--(mtls|http|https|dns|wg)|armory\s+install"
    or FileName matches regex @"(?i)^(beacon|artifact[0-9]*)\.(exe|dll)$"
    or ProcessCommandLine matches regex @"(?i)rundll32(\.exe)?\S*\s+\S+\.dll\S*,\s*StartW|downloadstring.{0,80}(__utm\.gif|pixel\.gif|dpixel)")
| extend Family = iff(FileName has "sliver" or ProcessCommandLine has_any ("sliver", "implants", "armory"), "Sliver", "Cobalt Strike")
| project Timestamp, DeviceName, AccountName, Family, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Sliver and Cobalt Strike Tooling Execution
id: 5f1c2d3e-4a5b-4c6d-8e7f-1a2b3c4d5e01
status: experimental
description: Detects execution of Sliver server and client binaries, Sliver implant generation command lines, Cobalt Strike beacon or artifact binaries and rundll32 StartW beacon DLL launches
references:
    - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2026
    - https://attack.mitre.org/software/S0633/
    - https://attack.mitre.org/software/S0154/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1219
    - attack.resource_development
    - attack.t1588.002
    - attack.s0633
    - attack.s0154
    - attack.tool.sliver
    - attack.tool.cobalt_strike
logsource:
    category: process_creation
    product: windows
detection:
    selection_sliver_img:
        Image|endswith:
            - '\sliver-server.exe'
            - '\sliver-client.exe'
            - '\sliver.exe'
    selection_sliver_cmd:
        CommandLine|contains:
            - 'sliver-server'
            - 'sliver-client'
            - 'implants new'
            - 'implants generate'
            - 'generate --mtls'
            - 'generate --http'
            - 'generate --dns'
            - 'generate --wg'
            - 'generate beacon --'
            - 'armory install'
    selection_cs_img:
        Image|endswith:
            - '\beacon.exe'
            - '\beacon.dll'
    selection_cs_startw:
        CommandLine|re: '(?i)rundll32(\.exe)?\S*\s+\S+\.dll\S*,\s*StartW'
    condition: 1 of selection_*
falsepositives:
    - Authorised red team or purple team exercises using Sliver or Cobalt Strike
    - Security researchers building implants in lab systems
level: high

Known false positives:

• Authorised red-team or purple-team operators running Sliver or Cobalt Strike
• Malware analysts or detection engineers testing implants in lab hosts

Tuning notes: Exclude hosts and accounts of the approved red team using a lookup (for example NOT [| inputlookup redteam_hosts.csv | fields host]). Enable Sysmon EventCode 1 with full command lines. Extend the Sliver regex with in-house implant names found in hunts. Keep earliest=-24h aligned with the schedule.

• 🔒 Offensive Tooling Download via LOLBin or Script to Raw IP, Sliver or Beacon Payload · unlock with TL Creds
• 🔒 Beacon Stager Execution: Encoded Hidden PowerShell, rundll32 StartW and Echo-to-Pipe Impersonation · unlock with TL Creds
• 🔒 Non-Browser Connections to [indicator] Destinations and Community-Observed Sibling C2 IPs · unlock with TL Creds
• 🔒 Sliver C2 Framework Binaries and Implant Generation on Linux Hosts · unlock with TL Creds
• 🔒 Cobalt Strike Sacrificial Process Spawned Without Arguments (rundll32, dllhost, werfault) · unlock with TL Creds
• 🔒 Cobalt Strike Default Malleable Profile URIs in Proxy Traffic · unlock with TL Creds
• 🔒 Cobalt Strike Default Named Pipes (SMB Beacon and Post-Exploitation Jobs) · unlock with TL Creds
• 🔒 Periodic Low-Jitter Outbound Beaconing Consistent with Sliver or Cobalt Strike C2 · unlock with TL Creds

Indicators of compromise for Sliver botnet C2 trends

As of 2026-11-03, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5111.

How Sliver botnet C2 trends works

Spamhaus published its half-yearly Botnet Threat Update on 2026-07-10, covering January–June 2026. The number of botnet command-and-control (C&C) servers observed fell 30% to 14,952, a reversal after two consecutive periods of growth (the preceding July–December 2025 update reported a 24% increase).

The most notable family-level shift is that Sliver, an open-source, cross-platform penetration-testing / adversary-emulation framework, overtook Cobalt Strike for the #1 position. Per Spamhaus, Sliver climbed from 1,904 to 3,008 detections (+58%), while Cobalt Strike fell from 3,451 to 1,110 (-68%), dropping from #1 to #4 - the largest percentage decline for Cobalt Strike since Spamhaus began tracking it. Remote Access Trojans remain the dominant malware type at 46.1% of tracked families, with pentest frameworks close behind at 38.6%.

On the infrastructure side, .cn domains used for botnet C&C surged 771% and reached #3 in the most-abused TLD table. India-based registrar PDR saw a 901% increase in domains associated with botnet C&Cs, whereas REGRU delivered a 90% reduction in abused registrations. Abuse of Russia-based registrars had been the headline in the prior period (a +9,608% surge in the July–December 2025 update).

Scope note: this is a trend/statistics report. The Spamhaus summary page contains no CVEs, no specific IOCs (IPs, domains, hashes) and no named threat actor, so none are attributed here. The full PDF report could not be read (the linked content.spamhaus.org PDFs returned unrelated artwork), so per-network, per-country and per-family breakdowns beyond the figures quoted above are not included. Severity is an analyst judgement. The Execution-tactic mapping (T1059) is an analyst inference from the nature of RAT/pentest-framework implants, not a statement in the report.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools

Resource Development

T1583.001 Domains; T1583.004 Server; T1588.002 Tool

Remediation for Sliver botnet C2 trends

Immediate actions

• Block Spamhaus DROP/BGP Botnet C&C (BCL) listed IPs and domains at the perimeter and in DNS resolvers
• Hunt for Sliver implant and Cobalt Strike beacon traffic and artifacts, not just Cobalt Strike, in proxy, DNS and EDR telemetry
• Review egress to .cn domains and to domains registered via registrars showing abuse spikes (e.g. PDR) for unexpected or newly registered destinations

Workarounds

• Use DNS filtering or RPZ to sinkhole newly registered domains in high-abuse TLD/registrar segments where business policy allows

Longer-term hardening

• Extend detection engineering coverage from Cobalt Strike-centric content to Sliver (mTLS, WireGuard, HTTP(S) and DNS C2 channels)
• Apply default-deny egress filtering and TLS inspection or JA3/JA4 monitoring for unknown C2 channels
• Subscribe to reputation feeds for botnet C&C infrastructure and automate ingestion into SIEM/firewall

Timeline of Sliver botnet C2 trends

• 2026-01-01 Start of the locked-ioc-4 January–June 2026 observation window for botnet C&C servers.
• 2026-01-12 locked-ioc-4 publishes the July–December 2025 update reporting a 24% increase in botnet C&C activity and a Russia-based registrar surge of +9,608% in botnet C&C domains.
• 2026-06-30 locked-ioc-7 domains used for botnet C&C surge 771% to #3 in the most-abused TLD table; India-based registrar locked-ioc-8 shows +901% in botnet C&C domains; locked-ioc-6 abused registrations fall 90%.
• 2026-06-30 Over the period locked-ioc-5 rises from 1,904 to 3,008 detections (+58%) to become the #1 botnet-associated family; locked-ioc-3 falls from 3,451 to 1,110 (-68%) and drops from #1 to #4.
• 2026-06-30 End of the observation window: 14,952 botnet C&C servers observed in the period, down 30%, reversing two consecutive periods of growth.
• 2026-07-10 locked-ioc-4 publishes the Botnet Threat Update January to June 2026.

Sources cited for Sliver botnet C2 trends

• Botnet Threat Update January to June 2026 (Spamhaus) spamhaus.org · Research · 2026-07-10
• Botnet Threat Update January to June 2026 (Spamhaus resources mirror) submit.spamhaus.org · Research · 2026-07-10
• Botnet Threat Update July to December 2025 (Spamhaus) spamhaus.org · Research · 2026-01-12
• Spamhaus Botnet Threat Update July to December 2024 (Malpedia library entry) malpedia.caad.fkie.fraunhofer.de · Research · 2025-01-10
• Spamhaus adds enriched botnet C&C data to CERT Insight portal suped.com · Blog
• Botnet Threat Update July to December 2025 (Security Boulevard) securityboulevard.com · News · 2026-01-12

More in threat intel

• NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028
• Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World Attacks
• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors