# Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C Family

> Spamhaus reports botnet C&C servers fell 30% to 14,952 in January–June 2026. Sliver rose 58% to 3,008 detections and displaced Cobalt Strike (down 68% to 1,110, now #4) as the leading botnet-associated malware family, while .cn domains hosting C&C infrastructure surged 771%.

- **Published:** 2026-11-03T01:17:45Z
- **Last reviewed:** 2026-11-03T01:17:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5111
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5111.png
- **ID:** TL-2026-5111
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

Spamhaus published its half-yearly Botnet Threat Update on 2026-07-10, covering January–June 2026. The number of botnet command-and-control (C&C) servers observed fell 30% to 14,952, a reversal after two consecutive periods of growth (the preceding July–December 2025 update reported a 24% increase).

The most notable family-level shift is that Sliver, an open-source, cross-platform penetration-testing / adversary-emulation framework, overtook Cobalt Strike for the #1 position. Per Spamhaus, Sliver climbed from 1,904 to 3,008 detections (+58%), while Cobalt Strike fell from 3,451 to 1,110 (-68%), dropping from #1 to #4 - the largest percentage decline for Cobalt Strike since Spamhaus began tracking it. Remote Access Trojans remain the dominant malware type at 46.1% of tracked families, with pentest frameworks close behind at 38.6%.

On the infrastructure side, .cn domains used for botnet C&C surged 771% and reached #3 in the most-abused TLD table. India-based registrar PDR saw a 901% increase in domains associated with botnet C&Cs, whereas REGRU delivered a 90% reduction in abused registrations. Abuse of Russia-based registrars had been the headline in the prior period (a +9,608% surge in the July–December 2025 update).

Scope note: this is a trend/statistics report. The Spamhaus summary page contains no CVEs, no specific IOCs (IPs, domains, hashes) and no named threat actor, so none are attributed here. The full PDF report could not be read (the linked content.spamhaus.org PDFs returned unrelated artwork), so per-network, per-country and per-family breakdowns beyond the figures quoted above are not included. Severity is an analyst judgement. The Execution-tactic mapping (T1059) is an analyst inference from the nature of RAT/pentest-framework implants, not a statement in the report.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.004 Server
- T1588.002 Tool
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1059 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Sliver and Cobalt Strike Tooling Execution on Endpoints (TL-2026-5111)** (`TL-2026-5111-SPL-001`)

Behaviour-first detection for execution of Sliver (MITRE S0633) and Cobalt Strike (S0154) tooling: Sliver server/client binaries and implant-generation command lines (generate --mtls/--http/--dns/--wg, implants new, armory install), plus Cobalt Strike beacon/artifact binaries, rundll32 StartW DLL beacon launches and download-cradle stagers using default profile URIs. Spamhaus H1 2026 data (TL-2026-5111) shows Sliver is now the #1 botnet C&C family (3,008 detections, +58%) while Cobalt Strike fell to #4 (1,110, -68%), so content must cover both. Maps to T1059, T1219 and T1588.002.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1219, T1588.002
- **Data sources:** sysmon, microsoft_defender_xdr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
| eval sliver=if(match(img,"(^|[^a-z0-9])sliver[a-z0-9._-]*$") OR match(cmd,"sliver-(client|server)|implants\\s+(new|generate)|generate\\s+(beacon\\s+)?--(mtls|http|https|dns|wg)|armory\\s+install"),1,0)
| eval cobalt_strike=if(match(img,"(beacon|artifact[0-9]*)\\.(exe|dll)$") OR match(cmd,"rundll32(\\.exe)?\\S*\\s+\\S+\\.dll\\S*,\\s*startw|downloadstring.{0,80}(__utm\\.gif|pixel\\.gif|dpixel)"),1,0)
| where sliver=1 OR cobalt_strike=1
| eval family=case(sliver=1 AND cobalt_strike=1,"Sliver + Cobalt Strike",sliver=1,"Sliver",true(),"Cobalt Strike")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_images values(CommandLine) as command_lines by host User Image family
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User family Image parent_images command_lines count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName has "sliver"
    or ProcessCommandLine matches regex @"(?i)sliver-(client|server)|implants\s+(new|generate)|generate\s+(beacon\s+)?--(mtls|http|https|dns|wg)|armory\s+install"
    or FileName matches regex @"(?i)^(beacon|artifact[0-9]*)\.(exe|dll)$"
    or ProcessCommandLine matches regex @"(?i)rundll32(\.exe)?\S*\s+\S+\.dll\S*,\s*StartW|downloadstring.{0,80}(__utm\.gif|pixel\.gif|dpixel)")
| extend Family = iff(FileName has "sliver" or ProcessCommandLine has_any ("sliver", "implants", "armory"), "Sliver", "Cobalt Strike")
| project Timestamp, DeviceName, AccountName, Family, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Sliver and Cobalt Strike Tooling Execution
id: 5f1c2d3e-4a5b-4c6d-8e7f-1a2b3c4d5e01
status: experimental
description: Detects execution of Sliver server and client binaries, Sliver implant generation command lines, Cobalt Strike beacon or artifact binaries and rundll32 StartW beacon DLL launches
references:
    - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2026
    - https://attack.mitre.org/software/S0633/
    - https://attack.mitre.org/software/S0154/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1219
    - attack.resource_development
    - attack.t1588.002
    - attack.s0633
    - attack.s0154
    - attack.tool.sliver
    - attack.tool.cobalt_strike
logsource:
    category: process_creation
    product: windows
detection:
    selection_sliver_img:
        Image|endswith:
            - '\sliver-server.exe'
            - '\sliver-client.exe'
            - '\sliver.exe'
    selection_sliver_cmd:
        CommandLine|contains:
            - 'sliver-server'
            - 'sliver-client'
            - 'implants new'
            - 'implants generate'
            - 'generate --mtls'
            - 'generate --http'
            - 'generate --dns'
            - 'generate --wg'
            - 'generate beacon --'
            - 'armory install'
    selection_cs_img:
        Image|endswith:
            - '\beacon.exe'
            - '\beacon.dll'
    selection_cs_startw:
        CommandLine|re: '(?i)rundll32(\.exe)?\S*\s+\S+\.dll\S*,\s*StartW'
    condition: 1 of selection_*
falsepositives:
    - Authorised red team or purple team exercises using Sliver or Cobalt Strike
    - Security researchers building implants in lab systems
level: high

```

**Known false positives:**

- Authorised red-team or purple-team operators running Sliver or Cobalt Strike
- Malware analysts or detection engineers testing implants in lab hosts

**Tuning notes:** Exclude hosts and accounts of the approved red team using a lookup (for example NOT [| inputlookup redteam_hosts.csv | fields host]). Enable Sysmon EventCode 1 with full command lines. Extend the Sliver regex with in-house implant names found in hunts. Keep earliest=-24h aligned with the schedule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Offensive Tooling Download via LOLBin or Script to Raw IP, Sliver or Beacon Payload (locked: unlock with TL Creds)
- Beacon Stager Execution: Encoded Hidden PowerShell, rundll32 StartW and Echo-to-Pipe Impersonation (locked: unlock with TL Creds)
- Non-Browser Connections to [indicator] Destinations and Community-Observed Sibling C2 IPs (locked: unlock with TL Creds)
- Sliver C2 Framework Binaries and Implant Generation on Linux Hosts (locked: unlock with TL Creds)
- Cobalt Strike Sacrificial Process Spawned Without Arguments (rundll32, dllhost, werfault) (locked: unlock with TL Creds)
- Cobalt Strike Default Malleable Profile URIs in Proxy Traffic (locked: unlock with TL Creds)
- Cobalt Strike Default Named Pipes (SMB Beacon and Post-Exploitation Jobs) (locked: unlock with TL Creds)
- Periodic Low-Jitter Outbound Beaconing Consistent with Sliver or Cobalt Strike C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Botnet Threat Update January to June 2026 (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2026)
- [Botnet Threat Update January to June 2026 (Spamhaus resources mirror)](https://submit.spamhaus.org/resources/botnet-threat-update-january-to-june-2026/)
- [Botnet Threat Update July to December 2025 (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/)
- [Botnet Threat Update July to December 2025 (Security Boulevard)](https://securityboulevard.com/2026/01/botnet-threat-update-july-to-december-2025/)
- [Spamhaus Botnet Threat Update July to December 2024 (Malpedia library entry)](https://malpedia.caad.fkie.fraunhofer.de/library/5519f131-8e18-4cdc-9257-c3bfafe7907f/)
- [Spamhaus adds enriched botnet C&C data to CERT Insight portal](https://www.suped.com/blog/spamhaus-adds-enriched-botnet-candc-data-to-cert-insight-portal)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5111