Threat reportThreat IntelligenceTL-2026-5113
Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet Malware
Spamhaus reports botnet command-and-control (C&C) activity increased 24% in July to December 2025 (21,425 C&Cs vs 17,258 in the prior six months). Remote Access Trojans (RATs) made up 42% of the Top 20 malware associated with botnets, and one Russia-based registrar saw a +9,608% surge in botnet C&C domains.
Key facts for TL-2026-5113
| Identifiers | TL-2026-5113 |
|---|---|
| Also known as | Spamhaus Botnet Threat Update H2 2025 |
| Severity | MEDIUM |
| Exploitation status | No known exploitation |
| Malware | Latrodectus - S1160, Venom RAT |
| MITRE ATT&CK techniques | T1059 Command and Scripting Interpreter, T1219 Remote Access Tools, T1583.001 Domains, T1583.003 Virtual Private Server, T1665 Hide Infrastructure |
| Motivation | UNKNOWN |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for TL-2026-5113
As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5113 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Latrodectus/RAT Loader — Rundll32 Executing User-Writable DLL From Script or Installer Parent
Behaviour-first detection of the execution stage used by Latrodectus and RAT-class malware named in TL-2026-5113 (Spamhaus H2 2025 botnet report): rundll32.exe loading a DLL from AppData/ProgramData/Temp/Public when launched by msiexec, a script host or a shell. Fires on the loader chain regardless of the specific sample or C2 host.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1218.011, T1204.002, T1059
- Data sources: sysmon
- Severity: high
- Confidence: medium
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=1 Image="*rundll32.exe" (ParentImage="*msiexec.exe" OR ParentImage="*wscript.exe" OR ParentImage="*cscript.exe" OR ParentImage="*mshta.exe" OR ParentImage="*powershell.exe" OR ParentImage="*cmd.exe") CommandLine="*.dll*" (CommandLine="*AppData*" OR CommandLine="*ProgramData*" OR CommandLine="*Temp*" OR CommandLine="*Users*Public*") | stats count min(_time) as firstSeen max(_time) as lastSeen values(CommandLine) as CommandLine values(ParentCommandLine) as ParentCommandLine by host User ParentImage | eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S"), lastSeen=strftime(lastSeen,"%Y-%m-%d %H:%M:%S")Microsoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where InitiatingProcessFileName in~ ("msiexec.exe","wscript.exe","cscript.exe","mshta.exe","powershell.exe","cmd.exe")
| where ProcessCommandLine contains ".dll"
| where ProcessCommandLine has_any ("AppData","ProgramData","Temp","Public")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256Sigma
title: Rundll32 Launching User-Writable DLL From Script Or Installer Parent (Latrodectus/RAT Loader Pattern)
id: 5b0e6c1a-3d47-4f2e-9a58-71c4d2e8b013
status: experimental
description: Detects rundll32.exe executing a DLL from a user-writable path when spawned by an installer, script host or shell, a loader pattern used by Latrodectus and RAT families such as VenomRAT (TL-2026-5113).
references:
- https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
- attack.defense-evasion
- attack.t1218.011
- attack.s1160
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: '\rundll32.exe'
selection_parent:
ParentImage|endswith:
- '\msiexec.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\cmd.exe'
selection_dll:
CommandLine|contains: '.dll'
selection_path:
CommandLine|contains:
- '\AppData\'
- '\ProgramData\'
- '\Temp\'
- '\Users\Public\'
condition: all of selection_*
falsepositives:
- Software installers that register DLLs via rundll32 from Temp
- Legitimate logon scripts invoking rundll32 against per-user DLLs
level: high
Known false positives:
- Software installers that register DLLs via rundll32 from a Temp directory
- Per-user line-of-business add-ins launched by logon scripts
Tuning notes: Baseline 7 days of results and exclude known installer hashes/signers and approved logon scripts by ParentCommandLine. Replace the sysmon index name with the one used in your environment. Tighten by requiring an export name after the DLL path (comma form) if noise is high.
- Latrodectus/RAT Delivery — Script Host Spawning Downloader or DLL Loader · unlock with TL Creds
- RAT/Loader Persistence — Scheduled Task Created With User-Writable Payload Path · unlock with TL Creds
- Hidden C2 Infrastructure — Contact With Post-CrazyRDP Bulletproof Hosters · unlock with TL Creds
- Msiexec Silent Remote Package Install — Latrodectus/RAT Delivery · unlock with TL Creds
- Unapproved Remote Access Tool Running From User-Writable Path · unlock with TL Creds
- Rundll32/Regsvr32 Outbound Connection To Public IP — Botnet Loader C2 · unlock with TL Creds
- RAT Persistence — Run Key Value Pointing To User-Writable Path · unlock with TL Creds
- Botnet C2 Beaconing — Regular Outbound Connections From User-Writable Binaries · unlock with TL Creds
Indicators of compromise for TL-2026-5113
As of 2026-11-03, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5113.
How Spamhaus Botnet Threat Update July to December 2025 works
This item is an aggregate trend report, not a single exploitation event. Spamhaus published its Botnet Threat Update for July to December 2025 on 2026-01-12. It states that botnet C&C activity rose 24% over the period. Search-indexed summaries of the report give 21,425 botnet C&Cs identified, against 17,258 in the previous six months. They also report that C&Cs located in the Seychelles rose +287% to 647, ranking it #8 in the Top 20 countries. The report finds that RATs account for 42% of the Top 20 malware families associated with botnets. One Russia-based registrar saw a +9,608% surge in botnet C&C domains, and the report notes that major cloud providers are taking action against botnet infrastructure.
Spamhaus' companion piece, 'Botnet Spotlight: Pressure rises on botnets - but the fight is far from over' (2026-01-27), adds network-level detail. Live botnet controllers fell at several large providers: Huawei -76%, Tencent -54% (while newly observed controllers rose +14%), Alibaba -46% (+16% newly observed), Amazon -43% and Google -41%. Contabo, DigitalOcean and ColoCrossing showed notable increases in botnet C&C activity. After the takedown of the Netherlands-based bulletproof hoster CrazyRDP, Spamhaus observed replacement providers including Virtualine, AS210558 and Simplecarrier. The Spotlight also cites Operation Endgame (1,025 servers taken down), the arrest of an alleged VenomRAT developer, and the resurfacing of Latrodectus after earlier law-enforcement action. It reports increases in botnet controller domains almost across the board, including at Western domain registrars.
Sourcing limits: the full PDF (which holds the Top 20 malware list, the named Russia-based registrar and per-network counts) could not be retrieved in readable form, so those details are not included. No CVEs, named threat actors or specific malicious IPs/domains are published on the report landing page. The IOC list therefore records sourced hosting networks and malware/operation names. These are aggregate network-level attributions and must not be used as blocklist entries for the providers' whole address space. The MITRE mapping is class-level (botnet infrastructure acquisition, RAT-style remote control, hidden/bulletproof hosting) and not tied to a specific intrusion; T1059 is a class-level RAT capability and is not stated in the sources.
MITRE ATT&CK techniques by tactic:
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1219 Remote Access Tools; T1665 Hide Infrastructure
Resource Development
Remediation for Spamhaus Botnet Threat Update July to December 2025
Immediate actions
- Ingest Spamhaus DROP/BCL and botnet C&C feeds into firewall, proxy and DNS filtering, and alert on matches
- Hunt outbound connections from endpoints to newly registered domains and to hosting networks with elevated botnet C&C counts
- Block or sinkhole known botnet C&C domains and IPs at the DNS resolver and egress firewall
Workarounds
- Restrict installation of unapproved remote-access software with application allow-listing
Longer-term hardening
- Deploy EDR with detections for RAT behavior (remote shell, screen capture, keylogging, unauthorized remote-access tooling)
- Apply egress filtering and restrict outbound traffic from servers to only required destinations
- Monitor newly registered and low-reputation domains and registrars in DNS telemetry
Timeline of Spamhaus Botnet Threat Update July to December 2025
- Spamhaus publishes 'Networks hosting botnet C&Cs: Same players, same problems'
- Start of the July to December 2025 reporting period
- Spamhaus publishes the Botnet Threat Update January to June 2025, reporting a 26% rise in botnet activity, the first increase in over 18 months
- End of the July to December 2025 reporting period
- Spamhaus publishes the Botnet Threat Update July to December 2025: C&C activity +24%, RATs 42% of Top 20 botnet malware, +9,608% C&C domain surge at a Russia-based registrar
- Spamhaus publishes 'Botnet Spotlight: Pressure rises on botnets', covering network-level changes, the locked-ioc-14 takedown, locked-ioc-2, the locked-ioc-15 developer arrest and the locked-ioc-8 resurgence
Sources cited for Spamhaus Botnet Threat Update July to December 2025
- Botnet Threat Update July to December 2025 (Spamhaus) spamhaus.org · Research · 2026-01-12
- Botnet Threat Update January to June 2025 (Spamhaus) spamhaus.org · Research · 2025-07-14
- Spamhaus Botnet C&C resource hub spamhaus.org · Research
- Spamhaus Botnet Threat Updates (report index) info.spamhaus.com · Research
- Botnet Threat Update July to December 2025 (Security Boulevard repost) securityboulevard.com · News
- Botnet Spotlight: Pressure rises on botnets - but the fight is far from over (Security Boulevard repost) securityboulevard.com · News · 2026-01-27
- Botnet Threat Update January to June 2025 (Security Boulevard repost) securityboulevard.com · News · 2025-07-14
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
