Researchers Map 1,250+ C2 Servers Across Russian Hosting Providers

Hunt.io analysis (Jan–Apr 2026) identifies a large concentration of command-and-control infrastructure across 165 Russian hosting providers — over 1,250 active C2 servers — driven by dominant frameworks (Keitaro), IoT botnets (Hajime, Mozi, Mirai), and misuse of post-exploitation tools (Cobalt Strike, Tactical RMM, Sliver). The report maps provider-level abuse to specific campaigns (e.g., Latrodectus, Lumma Stealer distribution, Remcos delivery), highlighting TimeWeb, WebHost1, and REG.RU as major hubs and recommending prioritization of high-risk networks for disruption and defensive action.