# Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity

> Spamhaus reports botnet command-and-control (C&C) activity rose 26% in January-June 2025, the first increase in over 18 months, with five new malware families entering its Top 20. Operation Endgame 2.0 (May 2025) pushed Latrodectus and DanaBot out of the Top 20.

- **Published:** 2026-11-03T03:13:20Z
- **Last reviewed:** 2026-11-03T03:13:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5117
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5117.png
- **ID:** TL-2026-5117
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

Spamhaus's Botnet Threat Update for January to June 2025 (published 2025-07-14) is an aggregate trend report on botnet C&C servers (controllers) tracked by Spamhaus. Its headline finding is that botnet activity increased by 26% during the reporting period, the first increase Spamhaus had observed for over 18 months. Five new malware families entered the Top 20 ranking of families associated with botnet C&Cs, and Spamhaus noted disappointing increases at a number of global networks hosting the most active botnet C&Cs; the same networks keep reappearing in the Top 20 hosting list.

Operation Endgame 2.0, announced 2025-05-23 after action between 2025-05-19 and 2025-05-22, targeted initial-access malware (Bumblebee, Latrodectus, Qakbot, DanaBot, Trickbot, WarmCookie). Spamhaus reports that following this operation both Latrodectus and DanaBot dropped out of the Top 20 malware families associated with botnet C&Cs. Spamhaus supported remediation by receiving compromised-credential data (username, endpoint URL, timestamp; covering 2025-01-01 to 2025-05-13). Spamhaus describes these initial-access families as tools criminals use to quietly breach systems before launching ransomware. The earlier Operation Endgame (May 2024) targeted IcedID, Smokeloader, SystemBC, Pikabot and Bumblebee.

SOURCING LIMITATION: the web page states only the headline figures. The detailed C&C counts, the five new family names, the Top 20 family ranking and the hosting-network ranking are in the PDF report, which could not be rendered as text during this research. No new-family names, hosting network rankings, ASNs, or network indicators are asserted here. Families listed as IOCs are those named in sourced Operation Endgame material, not a reconstruction of the Top 20. Defenders should treat this as trend context; Spamhaus separately cautions (H2 2025 update) that surging botnet controller domains mean C&C filtering should not rely on IP alone.

## MITRE ATT&CK

- T1071 Application Layer Protocol
- T1583 Acquire Infrastructure
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Loader Initial Access — Office/Archiver Spawning Script Host or LOLBin With User-Writable Payload (Latrodectus/Qakbot/Bumblebee Pattern)** (`TL-2026-5117-SPL-001`)

TL-2026-5117 (Spamhaus botnet C&C trend report, Operation Endgame 2.0): detects Office, PDF reader or archiver processes spawning rundll32, regsvr32, wscript, cscript, mshta or PowerShell with a payload in a user-writable path, a script/DLL export invocation or an encoded command. This is the initial-access staging behaviour shared by the loader families named in the research (Latrodectus, Qakbot, Bumblebee, WarmCookie, DanaBot) and is a ransomware precursor. Behaviour-first: no family-specific hashes or network indicators were published in the source.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1218.011
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage IN ("*\\winword.exe", "*\\excel.exe", "*\\outlook.exe", "*\\onenote.exe", "*\\acrord32.exe", "*\\winrar.exe", "*\\7zfm.exe") Image IN ("*\\rundll32.exe", "*\\regsvr32.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\powershell.exe") (CommandLine="*\\AppData\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*.dll,*" OR CommandLine="*.js*" OR CommandLine="*.vbs*" OR CommandLine="* -enc*") | stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as command_lines by host, User, ParentImage, Image | convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "onenote.exe", "acrord32.exe", "winrar.exe", "7zfm.exe")
| where FileName in~ ("rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe")
| where ProcessCommandLine has_any ("AppData", "ProgramData", "\\Temp\\", "\\Users\\Public\\", ".dll,", ".js", ".vbs", " -enc")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Office or Archiver Spawning Script Host or LOLBin With User-Writable Payload
id: 3d5e8a14-7c92-4b6f-a1e0-9f2b64c7d801
status: experimental
description: Detects Office, PDF reader or archiver processes spawning rundll32, regsvr32, wscript, cscript, mshta or PowerShell with a payload in a user-writable path, the initial-access staging pattern of loader families tracked in TL-2026-5117 (Latrodectus, Qakbot, Bumblebee, WarmCookie, DanaBot)
references:
  - https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025
  - https://www.spamhaus.org/endgame-2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\onenote.exe'
      - '\acrord32.exe'
      - '\winrar.exe'
      - '\7zfm.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '.dll,'
      - '.js'
      - '.vbs'
      - ' -enc'
  condition: all of selection_*
falsepositives:
  - Macro-enabled business workbooks or add-ins that legitimately launch PowerShell or script helpers
  - Software deployment or document-conversion tooling invoked from Office or archivers
level: high
```

**Known false positives:**

- Macro-enabled business workbooks or Office add-ins that legitimately launch PowerShell or script helpers
- Software deployment or document-conversion tooling invoked from Office or archive utilities

**Tuning notes:** Adjust the index name to your Sysmon index. Baseline for 14 days and allow-list known Office add-ins by CommandLine or signed binary hash. Tighten by requiring the path and DLL export patterns together, or add endpoint-reputation enrichment for the child image hash.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Loader Delivery — Explorer Launching Interpreter or LOLBin From Archive or Disk-Image Path (Qakbot/Bumblebee/Latrodectus Pattern) (locked: unlock with TL Creds)
- Loader Persistence — Scheduled Task Created to Run LOLBin or User-Writable Payload (Qakbot/Latrodectus/Bumblebee) (locked: unlock with TL Creds)
- Loader C2 Callback — LOLBin or Script Host Making Outbound Public Connections (Latrodectus/Qakbot/IcedID/DanaBot) (locked: unlock with TL Creds)
- Script-Stage Loader — Windows Script Host Running JS/VBS From User-Writable Path (Initial-Access Loader Delivery) (locked: unlock with TL Creds)
- Post-Loader Domain Discovery — nltest, Domain Admin Group Enumeration and AdFind (Ransomware Precursor Recon) (locked: unlock with TL Creds)
- Ingress Tool Transfer — certutil, bitsadmin or curl Staging Second-Stage Payloads (Loader Follow-On Download) (locked: unlock with TL Creds)
- Valid Account Fan-Out — Single Account Network Logons Across Many Hosts (Post-Loader Credential Abuse) (locked: unlock with TL Creds)
- Botnet C&C Beaconing — Low-Jitter Periodic Outbound Web Connections (Loader/Botnet Callback) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Botnet Threat Update January to June 2025 (Spamhaus)](https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025)
- [Botnet Threat Update January to June 2025 (PDF report)](https://content.spamhaus.org/22f3805e-27c4-4bd9-a06e-37df8dab3d8c.pdf)
- [Botnet Threat Update January to June 2025 (Security Boulevard mirror)](https://securityboulevard.com/2025/07/botnet-threat-update-january-to-june-2025/)
- [Operation Endgame 2.0 (Spamhaus)](https://www.spamhaus.org/endgame-2)
- [Botnets disrupted worldwide: Operation Endgame is back (Spamhaus)](https://securityboulevard.com/2025/05/botnets-disrupted-worldwide-operation-endgame-is-back)
- [Botnet Spotlight: Pressure rises on botnets, but the fight is far from over](https://securityboulevard.com/2026/01/botnet-spotlight-pressure-rises-on-botnets-but-the-fight-is-far-from-over/)
- [Inside DanaBot's Infrastructure: In Support of Operation Endgame II (Team Cymru)](https://www.team-cymru.com/post/inside-danabots-infrastructure-in-support-of-operation-endgame-ii)
- [A Brief History of DanaBot (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/brief-history-danabot-longtime-ecrime-juggernaut-disrupted-operation-endgame)
- [Latrodectus, are you coming back? (Bitsight)](https://www.bitsight.com/blog/latrodectus-are-you-coming-back)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5117