Skip to navigation

Threat reportThreat IntelligenceTL-2026-5112

Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP Takedown

mediumTRACKING

Spamhaus reports rising enforcement pressure on botnets in H2 2025: Operation Endgame server dismantlements, the CrazyRDP bulletproof hosting takedown in the Netherlands and the arrest of the alleged VenomRAT developer. Live botnet controllers fell at major networks (-41% to -76%), while domain-based controller hosting rose and Latrodectus resurfaced after prior law enforcement action. First disclosed .

Key facts for VenomRAT Latrodectus takedowns

IdentifiersTL-2026-5112
Also known asOperation Endgame Season 2, Botnet Spotlight H2 2025
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsMicrosoft Windows (endpoints targeted by VenomRAT and Latrodectus)
MalwareLatrodectus - S1160, Rhadamanthys, Venom RAT
MITRE ATT&CK techniquesT1005 Data from Local System, T1053.005 Scheduled Task, T1056.001 Keylogging, T1057 Process Discovery, T1071.001 Web Protocols, T1082 System Information Discovery, T1132.001 Standard Encoding, T1204.002 Malicious File, T1218.011 Rundll32, T1219 Remote Access Tools, T1497 Virtualization/Sandbox Evasion, T1566 Phishing and 4 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, finance, government administration, telecoms
Target regionsNorth America, Europe, Global
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for VenomRAT Latrodectus takedowns

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5112 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Latrodectus Loader - Rundll32 Execution of DLL From User-Writable Path (Exploitation)

TL-2026-5112 / Latrodectus (TA577, TA578 email-delivered loader, T1566, T1204.002): detects rundll32.exe proxy-executing a DLL or disguised payload (.dll/.dat/.tmp/.png/.jpg) from AppData, ProgramData, Temp, Downloads or Users\Public when launched by a script host, msiexec, Office, Outlook or an archive utility. Behaviour-first logic that does not depend on 2024-era IOCs, so it survives infrastructure rotation after Operation Endgame Season 2 (T1218.011).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566, T1204.002, T1218.011
  • Data sources: sysmon, defender_for_endpoint, windows_security
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\rundll32.exe" earliest=-24h ```Latrodectus loader pattern: rundll32 proxy-executing a DLL staged in a user-writable path```
| regex CommandLine="(?i)\\\\(AppData|ProgramData|Temp|Downloads|Users\\\\Public)\\\\[^ ,]+\.(dll|dat|tmp|png|jpg)"
| regex ParentImage="(?i)\\\\(wscript|cscript|mshta|msiexec|winword|excel|outlook|winrar|7zfm|7zg)\.exe$"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by Computer User ParentImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "msiexec.exe", "winword.exe", "excel.exe", "outlook.exe", "winrar.exe", "7zfm.exe", "7zg.exe")
| where ProcessCommandLine matches regex @"(?i)\\(AppData|ProgramData|Temp|Downloads|Users\\Public)\\[^ ,]+\.(dll|dat|tmp|png|jpg)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Latrodectus-Style Rundll32 Execution of DLL From User-Writable Path
id: 6f1c2a54-3b7e-4d90-8a41-2c9e7d5b1f03
status: experimental
description: Detects rundll32.exe proxy-executing a DLL or disguised payload from a user-writable path when spawned by a script host, msiexec, Office, Outlook or an archive tool. Matches the Latrodectus loader delivery chain (TA577/TA578 email campaigns).
references:
    - https://www.bitsight.com/blog/latrodectus-are-you-coming-back
    - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-spotlight-pressure-rises-on-botnets-but-the-fight-is-far-from-over
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1218.011
    - attack.s1160
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\winword.exe'
            - '\excel.exe'
            - '\outlook.exe'
            - '\winrar.exe'
            - '\7zFM.exe'
            - '\7zG.exe'
    selection_cli:
        CommandLine|re: '(?i)\\(AppData|ProgramData|Temp|Downloads|Users\\Public)\\[^ ,]+\.(dll|dat|tmp|png|jpg)'
    condition: all of selection_*
falsepositives:
    - Software installers or add-ins that register a DLL via rundll32 from a temp directory
    - Legitimate archive extraction followed by manual DLL registration by administrators
level: high

Known false positives:

  • Software installers or add-ins that register a DLL through rundll32 from a temp directory
  • Administrators manually registering DLLs extracted from an archive

Tuning notes: Exclude known-good installer parents and signed vendor DLL paths by hash or publisher. Enrich with Sysmon EventCode=7 image-load signature status to drop signed DLLs. Add ParentImage values for your environment (for example browsers) if hunting broader delivery chains.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Latrodectus Staging - Silent Msiexec Install of Remote MSI (Exploitation) · unlock with TL Creds
  • Latrodectus Reconnaissance - Discovery Tool Burst Spawned by Rundll32 (Post-Exploitation) · unlock with TL Creds
  • Latrodectus C2 - Historical C2 Domains and Rundll32 Beacon Cadence (C2) · unlock with TL Creds
  • Script Host Executing Script From Archive or Downloads Path (Exploitation) · unlock with TL Creds
  • Virtualization and Sandbox Artifact Query by Command Line (Post-Exploitation) · unlock with TL Creds
  • DNS Query for Latrodectus C2 Domains or Bulletproof Hosting Providers (C2) · unlock with TL Creds
  • Latrodectus Persistence - Scheduled Task Launching Rundll32 From User-Writable Path (Post-Exploitation) · unlock with TL Creds
  • Latrodectus C2 - HTTPS POST Beacon With Tob 1.1 User Agent or [indicator] URI (C2) · unlock with TL Creds

Indicators of compromise for VenomRAT Latrodectus takedowns

As of 2026-11-03, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5112.

Sample indicators (3 of 22)

  • Domain: aplihartom[.]com
  • File hash: 5edc39cbd89d3ba70a4737f823933af93f3c182134af8e34e0af9a316afaaca8
  • Domain: arsimonopa[.]com

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

22 indicators of compromise · unlock with TL Creds. Compare plans

How VenomRAT Latrodectus takedowns works

Spamhaus' Botnet Spotlight threat update for July-December 2025 (published 2026-01-27, author Jonas Arnold) describes a botnet landscape under increasing law enforcement pressure but far from defeated. Operation Endgame (Season 2) dismantled servers behind multiple botnet families, Dutch police took the CrazyRDP bulletproof hosting service offline, and the alleged developer of the VenomRAT remote access trojan was arrested. Spamhaus expects the arrest to cause a lasting decline in VenomRAT botnet controllers, and notes that Latrodectus, a previous law enforcement target, resurfaced in H2 2025, illustrating the limits of takedowns that are not accompanied by arrests.

Control-plane statistics: live botnet command-and-control (C&C) controllers declined at huawei.com (-76%), tencent.com (-54%), alibaba-inc.com (-46%), amazon.com (-43%) and google.com (-41%). Newly observed controllers nevertheless rose at tencent.com (+14%) and alibaba-inc.com (+16%). Spamhaus flags contabo.de, digitalocean.com and colocrossing.com as networks with significant increases in live or new controllers, and names virtualine.org, AS210558.net and simplecarrier.net as emerging bulletproof hosting providers adopting a 'separation of liabilities' operating model. Improved IP-based protections are offset by rising domain-based controller abuse across registrars and TLDs, leaving defenders with a 'mixed threat landscape'.

Supporting reporting: Greek authorities arrested a 38-year-old Albanian national in Athens on 2025-11-03 on a European arrest warrant issued by France; he is alleged to have created and sold VenomRAT since 2020. The arrest was part of the 2025-11-10 to 2025-11-13 Operation Endgame action coordinated by Europol, which also targeted the Rhadamanthys infostealer. On 2025-11-12 Dutch police seized 250 servers at a datacenter in The Hague used by a bulletproof hosting service active since 2022 and cited in more than 80 investigations; press reporting identifies it as CrazyRDP (no-KYC, no-logs VPS/RDP). Latrodectus was disrupted by Operation Endgame in May 2024, rebuilt, and was again targeted in Endgame Season 2 (announced 2025-05-23); public analysis describes a loader distributed by email campaigns (attributed to TA577 and TA578) that uses RC4-encrypted, Base64-encoded HTTPS POST C2 with beacons every 7.5-10 minutes. The Spamhaus report itself lists no CVEs, IOCs or attribution; the IOCs below come from the secondary Latrodectus analysis and are historical (2024-era) indicators.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.001 Keylogging

Persistence

T1053.005 Scheduled Task

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding; T1219 Remote Access Tools; T1573.001 Symmetric Cryptography

Execution

T1204.002 Malicious File

Defense Evasion

T1218.011 Rundll32; T1497 Virtualization/Sandbox Evasion

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1587.001 Malware

Remediation for VenomRAT Latrodectus takedowns

Immediate actions

  • Block or alert on Spamhaus DROP/BCL-listed IPs and Spamhaus-listed botnet C&C domains at DNS and perimeter
  • Hunt for historical Latrodectus indicators: HTTPS POSTs to /live/ with user agent 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)' and a mutex named 'running'
  • Review egress to VPS and bulletproof hosting ranges flagged by Spamhaus (Contabo, DigitalOcean, ColoCrossing, Virtualine, AS210558, Simplecarrier)

Workarounds

  • Restrict rundll32 execution of unsigned DLLs from user-writable paths
  • Alert on scheduled tasks created through COM by non-administrative processes

Longer-term hardening

  • Add domain-based (DNS RPZ / protective DNS) controls in addition to IP blocklists, since controller hosting is shifting to domains across registrars and TLDs
  • Deploy email filtering and EDR behavioral detection for loader and RAT delivery chains
  • Subscribe to Spamhaus botnet C&C and Operation Endgame updates

Affected and fixed versions

  • Microsoft — Windows (endpoints targeted by VenomRAT and Latrodectus)

Timeline of VenomRAT Latrodectus takedowns

  • locked-ioc-18 first detected in March 2020; the alleged developer is reported to have created and sold it since 2020 (month-level date; day approximated).
  • Operation Endgame (first phase, end of May 2024) targets major loaders and botnets; locked-ioc-16 infrastructure goes offline although it was not named in the operation (day approximated within end of May 2024).
  • locked-ioc-16 version 1.9 reported as released in February 2025 (month-level date; day approximated).
  • A wave of locked-ioc-16 activity begins in mid-March 2025 and increases through the end of April 2025.
  • Operation Endgame Season 2 announced, targeting Bumblebee, locked-ioc-16, Qakbot, DanaBot, Trickbot and WarmCookie.
  • Alleged locked-ioc-18 developer, a 38-year-old Albanian national, arrested in Athens on a European arrest warrant issued by France.
  • Europol-coordinated Operation Endgame action runs 10-13 November 2025, targeting locked-ioc-18 and the locked-ioc-14 infostealer.
  • Dutch police seize 250 servers at a datacenter in The Hague used by a bulletproof hosting service active since 2022 and cited in 80+ investigations; reporting identifies it as locked-ioc-19.
  • Spamhaus publishes the Botnet Spotlight threat update for July-December 2025, reporting controller declines at major networks, rising domain-based controllers and locked-ioc-16 resurfacing.

Sources cited for VenomRAT Latrodectus takedowns

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats