Category: Botnet Tracking

Amadey has been on our tracker since 2018 and it remains one of the most consistent early-stage loaders we follow. Its job has not changed: get a foothold, report in, and pull down whatever payload its operator currently prefers. What has changed through 2025 and into 2026 is what it stages. Since the May 2025 Lumma disruption, the Amadey infections we observe overwhelmingly pull StealC, Vidar, and increasingly Latrodectus. This report maps the current Amadey distribution infrastructure: the C2 layer, registrar and hosting concentration, and the sinkhole-derived victim geography. It is the infrastructure companion to our recent StealC v2 distribution analysis.

Role and volume

For the 30-day window (May 5 to June 3, 2026) our sinkholes captured roughly 1,720,000 Amadey check-ins across an estimated 60,000 unique hosts. That is in line with the 58,400 daily figure from our late-April weekly report. Amadey itself looks unchanged at the network level; the movement is all in what it delivers downstream.

C2 layer and passive-DNS pivots

Amadey panels continue to use a recognizable URI structure for check-in and task retrieval. Pivoting on the panel path pattern through passive DNS surfaced 38 active C2 hosts during the window. The hosts cluster into two operational groups: a long-lived group on bulletproof-adjacent hosting that has been stable for months, and a churning group on low-cost VPS providers that rotates every one to three weeks. The churning group is where most of the StealC-staging activity terminates.

Registrar and TLD concentration

The 38 C2 hosts resolved through 29 distinct domains. Registration concentrates heavily: three registrars account for 24 of the 29 domains, and the TLD distribution is dominated by low-cost generic TLDs. Registration timing clusters in short bursts, which is consistent with the operator pre-registering small batches ahead of each distribution wave rather than registering on demand. This maps to MITRE ATT&CK T1583.001 (Acquire Infrastructure: Domains).

Hosting-provider concentration

By autonomous system, the active C2 concentrates in a small number of providers. Two ASNs account for more than half of the observed C2 IPs during the window. We are deliberately not naming the providers here, because the population shifts faster than a published list stays accurate; the current set is in our feed export. The pattern matters more than the specific ASNs: a defender who blocks on the panel URI pattern and the current C2 set, then refreshes from a maintained feed, will catch more than one who blocks a static IP list.

What this means for defenders

Amadey is a staging problem, not an endpoint problem. By the time the loader has called home and pulled StealC, the credential theft is already in progress. The useful detection point is the loader check-in itself, which has a stable enough signature to hunt on. Organizations running a managed SOC should fold the Amadey panel pattern and the current C2 set into their hunting queries and alerting, and revisit them on the same cadence the infrastructure rotates. Teams that prefer to outsource that work to a managed-detection provider should make sure the provider actually tracks loader infrastructure at this level rather than only alerting on the final-stage payload; Falconer Security is one of the shops whose detection content works at the loader-and-infrastructure layer, which is the layer that catches an Amadey infection before the stealer stage completes. For the underlying family reference and existing detection coverage, the Malpedia Amadey entry and the MITRE ATT&CK S1018 profile are the right starting points, and active indicators are queryable on ThreatFox.

Victim geography

Sinkhole-derived victim distribution for the window, by unique source IP: United States (19 percent), India (14 percent), Brazil (11 percent), Indonesia (8 percent), Vietnam (7 percent). This tracks the broad commodity-loader pattern and matches the geography we reported for the wider tracker, with Vietnam and Indonesia continuing to rise as commodity-stealer destinations.

Indicators of compromise (sample)

Abbreviated. Full export in our feed at dev.virustracker.info/lists/; recent samples via MalwareBazaar.

Type	Indicator (truncated)	Context
SHA256	4b71e6…8a05	Amadey loader, current build
C2 host	185.215.113[.]xx	Long-lived group
C2 host	45.95.232[.]xx	Churning group, StealC staging
C2 domain	tracksys-panel[.]top	Active during window
URI pattern	/<hex>/index.php	Panel check-in

Methodology and references

Figures come from check-ins to our sinkhole and honeypot infrastructure during May 5 to June 3, 2026, deduplicated by source IP per 24-hour window. Check-in counts are a population proxy, not a confirmed victim count. The C2 and infrastructure observations come from passive-DNS pivoting on the panel pattern plus our own resolver telemetry. For continuity, the StealC v2 distribution analysis covers the payload this loader most often stages, and the StealC v2 packer YARA rules detect that downstream stage.

This is the first weekly tracking report we have published since April 2024. The pause was not editorial. The malware-as-a-service landscape we used to track went through three back-to-back disruption events in 2024 and 2025, we had to rebuild our sinkhole list around what was actually still routing, and several of the families we used to cover most often (Emotet, RedLine, Lumma in its original form, the IcedID and Bumblebee loader chain) are no longer the right things to count. The list of fourteen tracked botnets in this week’s report is not the same list we were tracking in 2024. The sections below explain the substitutions.

Key metrics

Total unique check-ins captured for the week of April 27 to May 3, 2026: 1,287,400 across fourteen tracked botnet and loader families. The headline number is roughly 50 percent higher than the figure we reported in the April 7 to 13, 2024 weekly report, but most of that growth is composition change rather than real volume growth. Five of the fourteen families on this week’s list did not exist or were not significant in our 2024 baseline. Two of the families that dominated the 2024 number (Lumma in its original form, RedLine) are now residual.

Notable changes

Amadey loader: 58,400 daily check-ins, up modestly from the 52,800 daily figure we last reported. Amadey has continued to play the role we described in 2024, an early-stage loader that pulls down whatever payload its operator currently prefers. Through 2025 that payload was usually Lumma. Since the May 2025 Lumma disruption, Amadey-staged infections we have observed are pulling StealC, Vidar, and increasingly Latrodectus instead. The loader itself looks unchanged at the network level. Malpedia profile. MITRE ATT&CK S1018.

StealC v2: 38,200 daily check-ins. StealC is the family that absorbed most of the displaced Lumma operator base after the Microsoft-led takedown seized roughly 2,300 Lumma C2 domains in May 2025. The v2 builder, which appeared in late 2024, added support for additional crypto wallet targets and a different network protocol that does not match the older StealC YARA rules. Our daily check-in figure from this family was below 4,000 in our 2024 baseline. The growth is the clearest single signal in this week’s data. Malpedia profile.

SmokeLoader: 9,100 daily check-ins, recovering from a near-zero floor after the May 2024 Operation Endgame action seized core SmokeLoader infrastructure. The current SmokeLoader population is being rebuilt by a smaller operator group on new C2 infrastructure that we have only partial coverage of. Compared to the 24,000 daily figure we reported pre-takedown, this is a meaningfully reduced footprint. Malpedia profile.

Latrodectus: 7,400 daily check-ins. Latrodectus is the loader that took over the niche left empty when IcedID and Bumblebee were swept up in Operation Endgame. It was not on our 2024 tracker because it had not yet emerged in volume. The infection chain typically begins with a brand-impersonation thread-hijacking email, then drops a JavaScript stage that pulls Latrodectus, which in turn loads a final-stage payload (most commonly an infostealer in the campaigns we tracked this week). Malpedia profile.

Vidar: 12,800 daily check-ins, slightly down from the steady-state figure we tracked in 2024 (around 14,000 daily). Vidar’s operator base has been consistent across the disruption events, which we read as evidence that the family is run by a longer-tenured group with operational discipline rather than a churning rotation of resellers. The C2 infrastructure has shifted to using Telegram channel pages and Steam profile bios as dead-drop resolvers more often than direct-IP C2. Malpedia profile.

Lumma (residual): 3,100 daily check-ins. Almost all of these are stale infections on hosts that have not been remediated, attempting to reach C2 domains that are now sinkholed by the takedown coalition or by us. We are tracking Lumma residual traffic as a separate line item rather than rolling it into StealC, because the residual signal is useful for measuring how slowly infected populations get cleaned up after a successful infrastructure action. Malpedia profile.

DanaBot (residual): 1,200 daily check-ins. DanaBot was disrupted in the second-round Operation Endgame action in 2025 alongside indictments against the operator group. As with Lumma, the residual telemetry is mostly stale infections. We expect this number to decline through 2026 as infected hosts get remediated or rebuilt, with no successor surge here because the operator group itself was charged. Malpedia profile.

SocGholish (FakeUpdates): 14,300 daily check-ins. Distribution framework rather than a single payload. Continues to be the dominant browser-update social-engineering chain on the open web, dropping a varying mix of follow-on payloads. We are tracking the SocGholish JS staging hits separately from the second-stage families they deliver, to avoid double-counting. Malpedia profile.

DarkGate: 5,600 daily check-ins. Stable volume. DarkGate’s operator group has continued to refresh its delivery lures (currently leaning on AI-tool-themed lures and PDF-attachment campaigns) but the malware itself has not changed enough to break our existing detections. Malpedia profile.

Strela Stealer: 2,400 daily check-ins. Narrow-target email-credential stealer, predominantly observed against Western and Central European mail providers. Its check-in volume looks small next to the broader infostealer families, but per-victim data exfiltration value is high because the targeting is intentional. Malpedia profile.

AsyncRAT: 22,100 daily check-ins. Commodity remote-access trojan, persistent across the entire reporting gap. AsyncRAT volume is mostly an indicator of how many unrelated low-budget operator groups are running off the same open-source codebase, which is why we treat its raw check-in count as less informative than the family-specific stealers. Malpedia profile.

AgentTesla: 6,400 daily check-ins. Long-tenured commodity infostealer, mostly delivered via attachment-based phishing into small and mid-sized organisations. Volume is similar to the level we last tracked it at. Malpedia profile.

Atomic Stealer (AMOS): 4,100 daily check-ins. macOS infostealer that did not appear in our 2024 tracker. The current distribution is dominated by sponsored-search-result lures pointing to fake installers for productivity software. We are reporting AMOS by daily check-ins rather than infection counts because the AMOS C2 protocol does not always issue persistent agent IDs, which makes the infection-count metric noisy. Malpedia profile.

Emotet: Removed from the tracker. We retired the Emotet line item in late 2024. The 2024 hypothesis we offered (that the declining Emotet check-ins pointed to either infrastructure rotation or a deliberate pause) resolved in the direction of the second option, with no meaningful Emotet activity observed in our sinkholes in any week of 2025 or 2026 to date. The original Emotet operator group has not, by any signal we can see, returned to operations.

Geographic distribution

Top infection sources by unique IP this week: United States (21 percent), India (15 percent), Brazil (10 percent), Indonesia (8 percent), Vietnam (6 percent). The top of the distribution remains broadly consistent with what we observed in 2024, with two changes worth noting. Russia has dropped out of the top five (it sat at 6 percent in our 2024 baseline), partly attributable to a measurable drop in commodity-stealer infections inside Russia and partly to operator targeting changes that exclude Russian-language locales. Vietnam has moved into the top five, driven mostly by SocGholish and AsyncRAT activity.

What changed since the last weekly report

The gap between this report and our previous weekly tracking post is roughly two years, and the contents reflect a real change in what is worth counting rather than just a change in our publication cadence. Three things specifically:

• Two of the families that anchored our 2024 baseline (RedLine and Lumma in its original form) were taken down in 2024 and 2025 respectively. We no longer count their original-infrastructure check-ins as live activity.
• Operation Endgame’s two rounds removed several loader families from the active count (IcedID, Bumblebee, Pikabot, SystemBC, and the original SmokeLoader infrastructure). Some have been replaced by successor families on this week’s list, in particular Latrodectus.
• The infostealer market has consolidated. StealC v2 has absorbed a significant share of what used to be the Lumma operator base. We expect this to be the dominant Windows infostealer on our tracker through the rest of 2026.

IOC sample

Sample IOCs from this week’s tracking, abbreviated for readability. The full week’s IOC export is published to our feed at dev.virustracker.info/lists/ and mirrored on our IOC partners. For the broader research community, recent samples for most of the families on this week’s list are available via MalwareBazaar and active C2 indicators are queryable on ThreatFox.

Family	Indicator type	Indicator (truncated)
StealC v2	SHA256	9c4f8a…e1d2 (loader stage)
StealC v2	C2 domain	cdn-update[.]live
Amadey	SHA256	4b71e6…8a05 (current build)
Latrodectus	C2 domain	secure-track[.]top
SocGholish	Stager URL pattern	/cdn/jquery-1.10.2.min.js?v=*
Atomic Stealer	C2 domain	arc-installer[.]net

Methodology and references

Numbers in this report come from check-ins received at our sinkhole and honeypot infrastructure during the week of April 27 to May 3, 2026, deduplicated by source IP per twenty-four-hour window. We treat the daily check-in count as a population proxy, not a victim count. Where we are reporting residual telemetry from disrupted infrastructure (Lumma, DanaBot), the numbers are check-in attempts to seized or sinkholed C2, not active infections.

For corroborating data on this week’s families: the abuse.ch family (URLhaus, MalwareBazaar, ThreatFox) remains the most useful public source for cross-checking active C2 and recent samples. Earlier reports from this site that connect to this week’s data are the original Lumma distribution campaign analysis, the Lumma packer YARA rules (still useful against StealC v2 with the StealC-specific signatures appended), and the Raccoon Stealer v3 analysis.

The next weekly report will cover the week of May 4 to 10, 2026, and will include a deeper section on the StealC v2 packer changes since the v1 release we YARA-scoped in 2024.

Weekly summary of botnet activity observed across our sinkhole and honeypot infrastructure. This week saw notable changes in loader activity correlating with the Lumma campaign reported earlier.

Key Metrics

Total unique check-ins captured: 847,000 across 14 tracked botnets. This represents a 12% increase from the previous week, driven primarily by Amadey loader activity.

Notable Changes

Amadey Loader: 340% increase in daily check-ins (from 12,000 to 52,800). This surge correlates directly with the new Lumma distribution campaign. Amadey is serving as the initial loader in the infection chain, downloading the Lumma payload after establishing persistence.

Emotet: Check-ins continue to decline for the third consecutive week, now averaging 8,400 daily versus 31,000 in March. This may indicate infrastructure rotation or a deliberate pause by the operators.

SmokeLoader: Stable at approximately 24,000 daily check-ins. No significant changes in infrastructure or delivery patterns.

Raccoon Stealer v3: Slight increase to 15,800 daily check-ins from 13,200 last week. We observed two new C2 servers added to the rotation.

Geographic Distribution

Top infection sources by unique IP: United States (23%), India (14%), Brazil (9%), Indonesia (7%), Russia (6%). The geographic distribution remains consistent with previous weeks.