# Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP Takedown

> Spamhaus reports rising enforcement pressure on botnets in H2 2025: Operation Endgame server dismantlements, the CrazyRDP bulletproof hosting takedown in the Netherlands and the arrest of the alleged VenomRAT developer. Live botnet controllers fell at major networks (-41% to -76%), while domain-based controller hosting rose and Latrodectus resurfaced after prior law enforcement action.

- **Published:** 2026-11-03T01:46:03Z
- **Last reviewed:** 2026-11-03T01:46:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5112
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5112.png
- **ID:** TL-2026-5112
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

Spamhaus' Botnet Spotlight threat update for July-December 2025 (published 2026-01-27, author Jonas Arnold) describes a botnet landscape under increasing law enforcement pressure but far from defeated. Operation Endgame (Season 2) dismantled servers behind multiple botnet families, Dutch police took the CrazyRDP bulletproof hosting service offline, and the alleged developer of the VenomRAT remote access trojan was arrested. Spamhaus expects the arrest to cause a lasting decline in VenomRAT botnet controllers, and notes that Latrodectus, a previous law enforcement target, resurfaced in H2 2025, illustrating the limits of takedowns that are not accompanied by arrests.

Control-plane statistics: live botnet command-and-control (C&C) controllers declined at huawei.com (-76%), tencent.com (-54%), alibaba-inc.com (-46%), amazon.com (-43%) and google.com (-41%). Newly observed controllers nevertheless rose at tencent.com (+14%) and alibaba-inc.com (+16%). Spamhaus flags contabo.de, digitalocean.com and colocrossing.com as networks with significant increases in live or new controllers, and names virtualine.org, AS210558.net and simplecarrier.net as emerging bulletproof hosting providers adopting a 'separation of liabilities' operating model. Improved IP-based protections are offset by rising domain-based controller abuse across registrars and TLDs, leaving defenders with a 'mixed threat landscape'.

Supporting reporting: Greek authorities arrested a 38-year-old Albanian national in Athens on 2025-11-03 on a European arrest warrant issued by France; he is alleged to have created and sold VenomRAT since 2020. The arrest was part of the 2025-11-10 to 2025-11-13 Operation Endgame action coordinated by Europol, which also targeted the Rhadamanthys infostealer. On 2025-11-12 Dutch police seized 250 servers at a datacenter in The Hague used by a bulletproof hosting service active since 2022 and cited in more than 80 investigations; press reporting identifies it as CrazyRDP (no-KYC, no-logs VPS/RDP). Latrodectus was disrupted by Operation Endgame in May 2024, rebuilt, and was again targeted in Endgame Season 2 (announced 2025-05-23); public analysis describes a loader distributed by email campaigns (attributed to TA577 and TA578) that uses RC4-encrypted, Base64-encoded HTTPS POST C2 with beacons every 7.5-10 minutes. The Spamhaus report itself lists no CVEs, IOCs or attribution; the IOCs below come from the secondary Latrodectus analysis and are historical (2024-era) indicators.

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1583.001 Domains
- T1587.001 Malware
- T1566 Phishing
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1218.011 Rundll32
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1056.001 Keylogging
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1132.001 Standard Encoding
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Latrodectus Loader - Rundll32 Execution of DLL From User-Writable Path (Exploitation)** (`TL-2026-5112-SPL-001`)

TL-2026-5112 / Latrodectus (TA577, TA578 email-delivered loader, T1566, T1204.002): detects rundll32.exe proxy-executing a DLL or disguised payload (.dll/.dat/.tmp/.png/.jpg) from AppData, ProgramData, Temp, Downloads or Users\Public when launched by a script host, msiexec, Office, Outlook or an archive utility. Behaviour-first logic that does not depend on 2024-era IOCs, so it survives infrastructure rotation after Operation Endgame Season 2 (T1218.011).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1204.002, T1218.011
- **Data sources:** sysmon, defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\rundll32.exe" earliest=-24h ```Latrodectus loader pattern: rundll32 proxy-executing a DLL staged in a user-writable path```
| regex CommandLine="(?i)\\\\(AppData|ProgramData|Temp|Downloads|Users\\\\Public)\\\\[^ ,]+\.(dll|dat|tmp|png|jpg)"
| regex ParentImage="(?i)\\\\(wscript|cscript|mshta|msiexec|winword|excel|outlook|winrar|7zfm|7zg)\.exe$"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by Computer User ParentImage
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "msiexec.exe", "winword.exe", "excel.exe", "outlook.exe", "winrar.exe", "7zfm.exe", "7zg.exe")
| where ProcessCommandLine matches regex @"(?i)\\(AppData|ProgramData|Temp|Downloads|Users\\Public)\\[^ ,]+\.(dll|dat|tmp|png|jpg)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Latrodectus-Style Rundll32 Execution of DLL From User-Writable Path
id: 6f1c2a54-3b7e-4d90-8a41-2c9e7d5b1f03
status: experimental
description: Detects rundll32.exe proxy-executing a DLL or disguised payload from a user-writable path when spawned by a script host, msiexec, Office, Outlook or an archive tool. Matches the Latrodectus loader delivery chain (TA577/TA578 email campaigns).
references:
    - https://www.bitsight.com/blog/latrodectus-are-you-coming-back
    - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-spotlight-pressure-rises-on-botnets-but-the-fight-is-far-from-over
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1218.011
    - attack.s1160
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\winword.exe'
            - '\excel.exe'
            - '\outlook.exe'
            - '\winrar.exe'
            - '\7zFM.exe'
            - '\7zG.exe'
    selection_cli:
        CommandLine|re: '(?i)\\(AppData|ProgramData|Temp|Downloads|Users\\Public)\\[^ ,]+\.(dll|dat|tmp|png|jpg)'
    condition: all of selection_*
falsepositives:
    - Software installers or add-ins that register a DLL via rundll32 from a temp directory
    - Legitimate archive extraction followed by manual DLL registration by administrators
level: high

```

**Known false positives:**

- Software installers or add-ins that register a DLL through rundll32 from a temp directory
- Administrators manually registering DLLs extracted from an archive

**Tuning notes:** Exclude known-good installer parents and signed vendor DLL paths by hash or publisher. Enrich with Sysmon EventCode=7 image-load signature status to drop signed DLLs. Add ParentImage values for your environment (for example browsers) if hunting broader delivery chains.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Latrodectus Staging - Silent Msiexec Install of Remote MSI (Exploitation) (locked: unlock with TL Creds)
- Latrodectus Reconnaissance - Discovery Tool Burst Spawned by Rundll32 (Post-Exploitation) (locked: unlock with TL Creds)
- Latrodectus C2 - Historical C2 Domains and Rundll32 Beacon Cadence (C2) (locked: unlock with TL Creds)
- Script Host Executing Script From Archive or Downloads Path (Exploitation) (locked: unlock with TL Creds)
- Virtualization and Sandbox Artifact Query by Command Line (Post-Exploitation) (locked: unlock with TL Creds)
- DNS Query for Latrodectus C2 Domains or Bulletproof Hosting Providers (C2) (locked: unlock with TL Creds)
- Latrodectus Persistence - Scheduled Task Launching Rundll32 From User-Writable Path (Post-Exploitation) (locked: unlock with TL Creds)
- Latrodectus C2 - HTTPS POST Beacon With Tob 1.1 User Agent or [indicator] URI (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- Domain: `aplihartom[.]com`
- File hash: `5edc39cbd89d3ba70a4737f823933af93f3c182134af8e34e0af9a316afaaca8`
- Domain: `arsimonopa[.]com`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Botnet Spotlight: Pressure rises on botnets - but the fight is far from over (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-spotlight-pressure-rises-on-botnets-but-the-fight-is-far-from-over)
- [Latrodectus, are you coming back? (Bitsight)](https://www.bitsight.com/blog/latrodectus-are-you-coming-back)
- [Dutch police takes down bulletproof hosting hub linked to 80+ cybercrime cases (Security Affairs)](https://securityaffairs.com/184757/cyber-crime/dutch-police-takes-down-bulletproof-hosting-hub-linked-to-80-cybercrime-cases.html)
- [Dutch police seizes 250 servers used by bulletproof hosting service (BleepingComputer)](https://bleepingcomputer.com/news/security/dutch-police-seizes-250-servers-used-by-bulletproof-hosting-service)
- [Greek Police Arrest Alleged Mastermind of the Venom RAT Malware Network (GreekReporter)](https://greekreporter.com/2025/11/14/greek-police-arrest-mastermind-venom-rat-malware-network/)
- [Cybercrime Mastermind Arrested in Athens in Major 11-Nation Operation (Greek City Times)](https://greekcitytimes.com/2025/11/15/cybercrime-mastermind-arrested-athens-operation-endgame/)
- [Spamhaus: Operation Endgame Season 2 coverage](https://www.spamhaus.org/endgame-2)
- [Security Brief: VenomRAT Defanged (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/security-brief-venomrat-defanged)
- [Bumblebee and Latrodectus Malware (The Hacker News)](https://thehackernews.com/2024/10/bumblebee-and-latrodectus-malware.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5112