Chinese Threat Actors Hosted 18,000 Active C2 Servers Across 48 Hosting Providers

Research using the Host Radar platform identified a massive network of over 18,000 active C2 servers across 48 Chinese hosting providers, accounting for roughly 84% of observed malicious activity during the analysed period; China Unicom, Alibaba Cloud, and Tencent disproportionately host this infrastructure. Major malware families (Mozi, ARL, Cobalt Strike, Vshell, Mirai) drive the activity, demonstrating that threat actors exploit cloud and hosting services for resilient command-and-control, complicating indicator-based detection and creating a concentrated, high-scale abuse ecosystem.