Tagging and Tracking Espionage Botnets
Summary: Dell SecureWorks researcher Joe Stewart spent 18 months cataloging more than 200 unique families of custom cyber-espionage malware and roughly 1,100 domain names registered by cyberspies, with almost 20,000 subdomains set up beneath them for command-and-control and malware distribution. Stewart, who presented the findings at Black Hat in Las Vegas, said the infrastructure clusters into two major groups, one pointing to Shanghai and the other to Beijing, with each botnet controlling only a few hundred computers at a time.
Why it matters: Stewart's estimate that for every espionage botnet discovered and publicized, hundreds more lie undetected on thousands of networks means the small size of each botnet is deliberate camouflage, not a sign of limited reach.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026