Skip to navigation

Threat reportMalwareTL-2026-5117

Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity

mediumACTIVE

Spamhaus reports botnet command-and-control (C&C) activity rose 26% in January-June 2025, the first increase in over 18 months, with five new malware families entering its Top 20. Operation Endgame 2.0 (May 2025) pushed Latrodectus and DanaBot out of the Top 20. First disclosed .

Key facts for Spamhaus H1 2025 botnet report

IdentifiersTL-2026-5117
Also known asSpamhaus Botnet Threat Update H1 2025, Operation Endgame 2.0
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
MalwareBumblebee - S1039, DanaBot, IcedID, Latrodectus - S1160, Pikabot - S1145, QakBot, Smoke Loader - S0226, SystemBC - S9001, Trickbot, Venom RAT, WarmCookie
ToolsTrick Bot
MITRE ATT&CK techniquesT1071 Application Layer Protocol, T1078 Valid Accounts, T1583 Acquire Infrastructure
MotivationFINANCIAL
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Spamhaus H1 2025 botnet report

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5117 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Loader Initial Access — Office/Archiver Spawning Script Host or LOLBin With User-Writable Payload (Latrodectus/Qakbot/Bumblebee Pattern)

TL-2026-5117 (Spamhaus botnet C&C trend report, Operation Endgame 2.0): detects Office, PDF reader or archiver processes spawning rundll32, regsvr32, wscript, cscript, mshta or PowerShell with a payload in a user-writable path, a script/DLL export invocation or an encoded command. This is the initial-access staging behaviour shared by the loader families named in the research (Latrodectus, Qakbot, Bumblebee, WarmCookie, DanaBot) and is a ransomware precursor. Behaviour-first: no family-specific hashes or network indicators were published in the source.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1218.011
  • Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage IN ("*\\winword.exe", "*\\excel.exe", "*\\outlook.exe", "*\\onenote.exe", "*\\acrord32.exe", "*\\winrar.exe", "*\\7zfm.exe") Image IN ("*\\rundll32.exe", "*\\regsvr32.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\powershell.exe") (CommandLine="*\\AppData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*.dll,*" OR CommandLine="*.js*" OR CommandLine="*.vbs*" OR CommandLine="* -enc*") | stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as command_lines by host, User, ParentImage, Image | convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "onenote.exe", "acrord32.exe", "winrar.exe", "7zfm.exe")
| where FileName in~ ("rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe")
| where ProcessCommandLine has_any ("AppData", "ProgramData", "\\Temp\\", "\\Users\\Public\\", ".dll,", ".js", ".vbs", " -enc")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256

Sigma

title: Office or Archiver Spawning Script Host or LOLBin With User-Writable Payload
id: 3d5e8a14-7c92-4b6f-a1e0-9f2b64c7d801
status: experimental
description: Detects Office, PDF reader or archiver processes spawning rundll32, regsvr32, wscript, cscript, mshta or PowerShell with a payload in a user-writable path, the initial-access staging pattern of loader families tracked in TL-2026-5117 (Latrodectus, Qakbot, Bumblebee, WarmCookie, DanaBot)
references:
  - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025
  - https://www.spamhaus.org/endgame-2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\onenote.exe'
      - '\acrord32.exe'
      - '\winrar.exe'
      - '\7zfm.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '.dll,'
      - '.js'
      - '.vbs'
      - ' -enc'
  condition: all of selection_*
falsepositives:
  - Macro-enabled business workbooks or add-ins that legitimately launch PowerShell or script helpers
  - Software deployment or document-conversion tooling invoked from Office or archivers
level: high

Known false positives:

  • Macro-enabled business workbooks or Office add-ins that legitimately launch PowerShell or script helpers
  • Software deployment or document-conversion tooling invoked from Office or archive utilities

Tuning notes: Adjust the index name to your Sysmon index. Baseline for 14 days and allow-list known Office add-ins by CommandLine or signed binary hash. Tighten by requiring the path and DLL export patterns together, or add endpoint-reputation enrichment for the child image hash.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Loader Delivery — Explorer Launching Interpreter or LOLBin From Archive or Disk-Image Path (Qakbot/Bumblebee/Latrodectus Pattern) · unlock with TL Creds
  • Loader Persistence — Scheduled Task Created to Run LOLBin or User-Writable Payload (Qakbot/Latrodectus/Bumblebee) · unlock with TL Creds
  • Loader C2 Callback — LOLBin or Script Host Making Outbound Public Connections (Latrodectus/Qakbot/IcedID/DanaBot) · unlock with TL Creds
  • Script-Stage Loader — Windows Script Host Running JS/VBS From User-Writable Path (Initial-Access Loader Delivery) · unlock with TL Creds
  • Post-Loader Domain Discovery — nltest, Domain Admin Group Enumeration and AdFind (Ransomware Precursor Recon) · unlock with TL Creds
  • Ingress Tool Transfer — certutil, bitsadmin or curl Staging Second-Stage Payloads (Loader Follow-On Download) · unlock with TL Creds
  • Valid Account Fan-Out — Single Account Network Logons Across Many Hosts (Post-Loader Credential Abuse) · unlock with TL Creds
  • Botnet C&C Beaconing — Low-Jitter Periodic Outbound Web Connections (Loader/Botnet Callback) · unlock with TL Creds

Indicators of compromise for Spamhaus H1 2025 botnet report

As of 2026-11-03, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5117.

12 indicators of compromise · unlock with TL Creds. Compare plans

How Spamhaus H1 2025 botnet report works

Spamhaus's Botnet Threat Update for January to June 2025 (published 2025-07-14) is an aggregate trend report on botnet C&C servers (controllers) tracked by Spamhaus. Its headline finding is that botnet activity increased by 26% during the reporting period, the first increase Spamhaus had observed for over 18 months. Five new malware families entered the Top 20 ranking of families associated with botnet C&Cs, and Spamhaus noted disappointing increases at a number of global networks hosting the most active botnet C&Cs; the same networks keep reappearing in the Top 20 hosting list.

Operation Endgame 2.0, announced 2025-05-23 after action between 2025-05-19 and 2025-05-22, targeted initial-access malware (Bumblebee, Latrodectus, Qakbot, DanaBot, Trickbot, WarmCookie). Spamhaus reports that following this operation both Latrodectus and DanaBot dropped out of the Top 20 malware families associated with botnet C&Cs. Spamhaus supported remediation by receiving compromised-credential data (username, endpoint URL, timestamp; covering 2025-01-01 to 2025-05-13). Spamhaus describes these initial-access families as tools criminals use to quietly breach systems before launching ransomware. The earlier Operation Endgame (May 2024) targeted IcedID, Smokeloader, SystemBC, Pikabot and Bumblebee.

SOURCING LIMITATION: the web page states only the headline figures. The detailed C&C counts, the five new family names, the Top 20 family ranking and the hosting-network ranking are in the PDF report, which could not be rendered as text during this research. No new-family names, hosting network rankings, ASNs, or network indicators are asserted here. Families listed as IOCs are those named in sourced Operation Endgame material, not a reconstruction of the Top 20. Defenders should treat this as trend context; Spamhaus separately cautions (H2 2025 update) that surging botnet controller domains mean C&C filtering should not rely on IP alone.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts

Resource Development

T1583 Acquire Infrastructure

Remediation for Spamhaus H1 2025 botnet report

Immediate actions

  • Subscribe to or ingest Spamhaus botnet C&C controller data (e.g. BCL/DROP-style feeds) and block matching destinations at DNS, proxy and firewall layers
  • Hunt for outbound connections from endpoints to known botnet C&C infrastructure and investigate hits as potential initial-access malware infections
  • Reset credentials for accounts appearing in infostealer or botnet credential disclosures

Workarounds

  • Restrict egress to approved destinations for servers and sensitive segments

Longer-term hardening

  • Do not rely on IP-based filtering alone; add domain-based and behavioral C&C detection
  • Deploy EDR with loader/initial-access malware behavioral detection to catch infections before ransomware staging
  • Monitor hosting-network concentration of C&C traffic in egress logs

Timeline of Spamhaus H1 2025 botnet report

  • Start of the locked-ioc-8 reporting period and of the compromised-credential data window later shared for Operation Endgame 2.0
  • End of the compromised-credential data window (2025-01-01 to 2025-05-13) provided to locked-ioc-8 for remediation
  • Operation Endgame 2.0 action begins against locked-ioc-4, locked-ioc-1, locked-ioc-11, locked-ioc-9, locked-ioc-5 and locked-ioc-3 infrastructure (action ran 19-22 May)
  • Operation Endgame 2.0 officially announced; over 300 servers and around 650 domains reported disrupted
  • End of January-June 2025 reporting period; botnet C&C activity up 26% over the prior period, with locked-ioc-1 and locked-ioc-9 out of the Top 20 after Endgame 2.0
  • locked-ioc-8 publishes Botnet Threat Update January to June 2025: first increase in over 18 months; five new families enter the Top 20
  • locked-ioc-8 Botnet Spotlight article on enforcement pressure published, noting locked-ioc-1 resurfaced in H2 2025

Sources cited for Spamhaus H1 2025 botnet report

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats