Weekly summary of botnet activity observed across our sinkhole and honeypot infrastructure. This week saw notable changes in loader activity correlating with the Lumma campaign reported earlier.
Key Metrics
Total unique check-ins captured: 847,000 across 14 tracked botnets. This represents a 12% increase from the previous week, driven primarily by Amadey loader activity.
Notable Changes
Amadey Loader: 340% increase in daily check-ins (from 12,000 to 52,800). This surge correlates directly with the new Lumma distribution campaign. Amadey is serving as the initial loader in the infection chain, downloading the Lumma payload after establishing persistence.
Emotet: Check-ins continue to decline for the third consecutive week, now averaging 8,400 daily versus 31,000 in March. This may indicate infrastructure rotation or a deliberate pause by the operators.
SmokeLoader: Stable at approximately 24,000 daily check-ins. No significant changes in infrastructure or delivery patterns.
Raccoon Stealer v3: Slight increase to 15,800 daily check-ins from 13,200 last week. We observed two new C2 servers added to the rotation.
Geographic Distribution
Top infection sources by unique IP: United States (23%), India (14%), Brazil (9%), Indonesia (7%), Russia (6%). The geographic distribution remains consistent with previous weeks.