Inside Eastern Europe's C2 Sprawl: 3,900+ Servers, 302 Providers, One Host Doing Half the Work

**Executive summary:** Over a three-month analysis across 10 Eastern European countries, Host Radar identified >3,900 active C2 servers concentrated across 302 providers—notably Friendhosting LTD (Bulgaria) hosting ~2,100 C2s—revealing large-scale abuse of hosting infrastructure by commodity cybercrime and state-linked actors; the report highlights dominant malware families (Keitaro, Tactical RMM, Acunetix), active campaigns and actors (Cloud Atlas, ShinyHunters, Black Basta, etc.), and live exploitation of CVE-2026-35273 against hundreds of PeopleSoft instances, recommending defenders prioritize provider- and ASN-level risk signals rather than ephemeral IP/domain indicators.