# Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet Malware

> Spamhaus reports botnet command-and-control (C&C) activity increased 24% in July to December 2025 (21,425 C&Cs vs 17,258 in the prior six months). Remote Access Trojans (RATs) made up 42% of the Top 20 malware associated with botnets, and one Russia-based registrar saw a +9,608% surge in botnet C&C domains.

- **Published:** 2026-11-03T02:10:48Z
- **Last reviewed:** 2026-11-03T02:10:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5113
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5113.png
- **ID:** TL-2026-5113
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

This item is an aggregate trend report, not a single exploitation event. Spamhaus published its Botnet Threat Update for July to December 2025 on 2026-01-12. It states that botnet C&C activity rose 24% over the period. Search-indexed summaries of the report give 21,425 botnet C&Cs identified, against 17,258 in the previous six months. They also report that C&Cs located in the Seychelles rose +287% to 647, ranking it #8 in the Top 20 countries. The report finds that RATs account for 42% of the Top 20 malware families associated with botnets. One Russia-based registrar saw a +9,608% surge in botnet C&C domains, and the report notes that major cloud providers are taking action against botnet infrastructure.

Spamhaus' companion piece, 'Botnet Spotlight: Pressure rises on botnets - but the fight is far from over' (2026-01-27), adds network-level detail. Live botnet controllers fell at several large providers: Huawei -76%, Tencent -54% (while newly observed controllers rose +14%), Alibaba -46% (+16% newly observed), Amazon -43% and Google -41%. Contabo, DigitalOcean and ColoCrossing showed notable increases in botnet C&C activity. After the takedown of the Netherlands-based bulletproof hoster CrazyRDP, Spamhaus observed replacement providers including Virtualine, AS210558 and Simplecarrier. The Spotlight also cites Operation Endgame (1,025 servers taken down), the arrest of an alleged VenomRAT developer, and the resurfacing of Latrodectus after earlier law-enforcement action. It reports increases in botnet controller domains almost across the board, including at Western domain registrars.

Sourcing limits: the full PDF (which holds the Top 20 malware list, the named Russia-based registrar and per-network counts) could not be retrieved in readable form, so those details are not included. No CVEs, named threat actors or specific malicious IPs/domains are published on the report landing page. The IOC list therefore records sourced hosting networks and malware/operation names. These are aggregate network-level attributions and must not be used as blocklist entries for the providers' whole address space. The MITRE mapping is class-level (botnet infrastructure acquisition, RAT-style remote control, hidden/bulletproof hosting) and not tied to a specific intrusion; T1059 is a class-level RAT capability and is not stated in the sources.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1219 Remote Access Tools
- T1665 Hide Infrastructure
- T1059 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Latrodectus/RAT Loader — Rundll32 Executing User-Writable DLL From Script or Installer Parent** (`TL-2026-5113-SPL-001`)

Behaviour-first detection of the execution stage used by Latrodectus and RAT-class malware named in TL-2026-5113 (Spamhaus H2 2025 botnet report): rundll32.exe loading a DLL from AppData/ProgramData/Temp/Public when launched by msiexec, a script host or a shell. Fires on the loader chain regardless of the specific sample or C2 host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.011, T1204.002, T1059
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=1 Image="*rundll32.exe" (ParentImage="*msiexec.exe" OR ParentImage="*wscript.exe" OR ParentImage="*cscript.exe" OR ParentImage="*mshta.exe" OR ParentImage="*powershell.exe" OR ParentImage="*cmd.exe") CommandLine="*.dll*" (CommandLine="*AppData*" OR CommandLine="*ProgramData*" OR CommandLine="*Temp*" OR CommandLine="*Users*Public*") | stats count min(_time) as firstSeen max(_time) as lastSeen values(CommandLine) as CommandLine values(ParentCommandLine) as ParentCommandLine by host User ParentImage | eval firstSeen=strftime(firstSeen,"%Y-%m-%d %H:%M:%S"), lastSeen=strftime(lastSeen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where InitiatingProcessFileName in~ ("msiexec.exe","wscript.exe","cscript.exe","mshta.exe","powershell.exe","cmd.exe")
| where ProcessCommandLine contains ".dll"
| where ProcessCommandLine has_any ("AppData","ProgramData","Temp","Public")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Rundll32 Launching User-Writable DLL From Script Or Installer Parent (Latrodectus/RAT Loader Pattern)
id: 5b0e6c1a-3d47-4f2e-9a58-71c4d2e8b013
status: experimental
description: Detects rundll32.exe executing a DLL from a user-writable path when spawned by an installer, script host or shell, a loader pattern used by Latrodectus and RAT families such as VenomRAT (TL-2026-5113).
references:
    - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059
    - attack.defense-evasion
    - attack.t1218.011
    - attack.s1160
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_parent:
        ParentImage|endswith:
            - '\msiexec.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    selection_dll:
        CommandLine|contains: '.dll'
    selection_path:
        CommandLine|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Temp\'
            - '\Users\Public\'
    condition: all of selection_*
falsepositives:
    - Software installers that register DLLs via rundll32 from Temp
    - Legitimate logon scripts invoking rundll32 against per-user DLLs
level: high

```

**Known false positives:**

- Software installers that register DLLs via rundll32 from a Temp directory
- Per-user line-of-business add-ins launched by logon scripts

**Tuning notes:** Baseline 7 days of results and exclude known installer hashes/signers and approved logon scripts by ParentCommandLine. Replace the sysmon index name with the one used in your environment. Tighten by requiring an export name after the DLL path (comma form) if noise is high.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Latrodectus/RAT Delivery — Script Host Spawning Downloader or DLL Loader (locked: unlock with TL Creds)
- RAT/Loader Persistence — Scheduled Task Created With User-Writable Payload Path (locked: unlock with TL Creds)
- Hidden C2 Infrastructure — Contact With Post-CrazyRDP Bulletproof Hosters (locked: unlock with TL Creds)
- Msiexec Silent Remote Package Install — Latrodectus/RAT Delivery (locked: unlock with TL Creds)
- Unapproved Remote Access Tool Running From User-Writable Path (locked: unlock with TL Creds)
- Rundll32/Regsvr32 Outbound Connection To Public IP — Botnet Loader C2 (locked: unlock with TL Creds)
- RAT Persistence — Run Key Value Pointing To User-Writable Path (locked: unlock with TL Creds)
- Botnet C2 Beaconing — Regular Outbound Connections From User-Writable Binaries (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Botnet Threat Update July to December 2025 (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/)
- [Botnet Threat Update July to December 2025 (Security Boulevard repost)](https://securityboulevard.com/2026/01/botnet-threat-update-july-to-december-2025/)
- [Botnet Spotlight: Pressure rises on botnets - but the fight is far from over (Security Boulevard repost)](https://securityboulevard.com/2026/01/botnet-spotlight-pressure-rises-on-botnets-but-the-fight-is-far-from-over/)
- [Botnet Threat Update January to June 2025 (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/)
- [Botnet Threat Update January to June 2025 (Security Boulevard repost)](https://securityboulevard.com/2025/07/botnet-threat-update-january-to-june-2025/)
- [Spamhaus Botnet C&C resource hub](https://www.spamhaus.org/resource-hub/botnet-c-c/)
- [Spamhaus Botnet Threat Updates (report index)](https://info.spamhaus.com/botnet-threat-updates)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5113