When the Exploit Layer Is Where Botnet Tracking Has to Begin
A recent wave of botnet activity tied to modified versions of the CIA's leaked Hive attack kit illustrates a pattern that security teams frequently misread. The Hive kit, originally exposed through WikiLeaks disclosures, has since been adopted and modified by criminal and state-adjacent operators. A variant known as Xdr33 surfaced earlier this year, repurposing Hive's beacon and communication structure for use in criminal infrastructure. The original code's stealth architecture — designed to mimic legitimate TLS traffic and avoid behavioral detection — translated directly into botnet C2 utility. What made this operationally significant for defenders is that the exploit chain began well before any observable scanning or traffic anomalies appeared on monitored segments.
This is the pattern that consistently trips up security operations teams: botnet infrastructure is assembled and tested quietly, often over weeks, before any victim-facing activity registers on conventional monitoring. By the time a flood of beaconing traffic or scanning probes appears in your logs, the C2 framework is already hardened and redundant. Tracking a botnet effectively means working backwards from observable indicators to infrastructure pivot points, not waiting for the campaign to announce itself through volume.
The Iran-linked Cavern Manticore group, recently exposed for operating a modular C2 framework, followed exactly this model. Their infrastructure relied on staged components that could be swapped independently — communication modules, payload delivery, and persistence mechanisms operated as separate layers. This modular approach makes single-point takedowns ineffective and means that blocking one IP or domain leaves the underlying architecture intact.
How Modern Botnet C2 Infrastructure Gets Built
Understanding how botnet operators construct their infrastructure is a prerequisite for tracking it meaningfully. The days of centralized IRC channels and single-domain command nodes are well behind us. Contemporary botnet C2 infrastructure typically involves multiple layers of indirection, often including:
- Fast-flux DNS: A technique where the A records for a C2 domain rotate through dozens or hundreds of IP addresses, each with a TTL of 60 seconds or less. This makes IP-based blocking nearly useless as a primary control.
- Domain generation algorithms (DGAs): Infected nodes use a deterministic algorithm seeded by date or other shared values to generate domain names on the fly. The botnet operator registers only a small fraction of generated domains, but bots cycle through the list until they reach a live one.
- Bulletproof hosting: C2 nodes frequently reside on autonomous systems known to ignore abuse reports. Tracking which ASNs host recurring C2 infrastructure gives defenders predictive context about where the next campaign is likely to stage.
- Compromised legitimate infrastructure: Botnet operators increasingly route traffic through compromised routers, NAS devices, and IP cameras to provide cover. The recent disclosure of criminals selling access to Chinese surveillance cameras connects directly to this pattern — compromised Hikvision cameras have appeared in botnet proxy layers, and active scanning for Hikvision's Intelligent Security API was documented in mid-July, suggesting reconnaissance for exactly this purpose.
- Peer-to-peer C2: Some sophisticated botnets distribute command issuance across infected nodes themselves, eliminating a single C2 tier entirely. Sinkholing becomes more complex when there is no central domain to redirect.
Reading the Telemetry Before the Campaign Peaks
The early indicators of botnet staging activity appear in telemetry that most teams collect but few analyze with the right cadence. The following signal categories deserve specific attention.
DNS Resolution Patterns
High-frequency resolution attempts against newly registered domains, particularly domains with algorithmically generated character patterns, are among the earliest observable signals. A host resolving dozens of NXDOMAIN responses per minute against domains that share lexical structure — similar length, similar character distribution, no semantic meaning — is a strong indicator of DGA activity. Passive DNS logging that captures failed resolutions is as important here as logging successful ones. Many teams log successful DNS queries only, which means DGA-driven bots cycle through their domain list invisibly until they hit a live C2 node.
In your DNS resolver logs, look for hosts generating NXDOMAIN volumes that spike above their baseline. A workstation that normally generates five to ten NXDOMAIN responses per hour generating three hundred within a ten-minute window is worth immediate investigation regardless of what those domains are.
Beaconing Behavior in NetFlow and Packet Capture
Botnet beacons are periodic by design. An infected node reaches out to its C2 on a schedule, often with jitter added to avoid perfectly regular intervals. The jitter is the tell. In raw NetFlow data, beaconing shows up as repeated connections to the same destination IP or domain at intervals that cluster around a mean — say, every 300 seconds plus or minus 45 seconds. The regularity under the randomness is what distinguishes automated beaconing from human-driven browsing.
Tools like Rita (Real Intelligence Threat Analytics), developed by Active Countermeasures, are specifically built to surface this pattern in stored NetFlow data. Running Rita against 24-hour NetFlow exports as a scheduled job can surface beaconing that real-time alerting misses because the pattern only becomes statistically visible over time. A single connection to an unusual IP means nothing; twenty connections to the same IP at regular intervals over eight hours means a great deal.
Lateral Movement Precursors
Once an initial node is infected, botnet operators often attempt lateral movement to expand the number of controllable nodes within the environment or to find higher-value systems. In authentication logs, this surfaces as a single host initiating SMB connections or WMI calls to multiple peers in rapid succession. This differs from normal IT operations: a workstation initiating connections to fifteen other workstations within a two-minute window is not standard behavior in any environment that has not explicitly documented a scanning or management process that would cause it.
Correlating internal scan activity with external beaconing from the same host closes the loop. A host both beaconing outbound and scanning laterally inbound is a confirmed infection requiring immediate containment rather than continued monitoring.
Mapping C2 Infrastructure Through Pivot Analysis
Once you have identified a confirmed C2 endpoint — whether a domain, IP, or both — the investigation expands through structured pivoting. The goal is to identify the full scope of infrastructure the operator is using before taking any action that would alert them to the investigation.
Certificate Transparency Logs
Botnet operators who use TLS for C2 communication frequently obtain certificates for their C2 domains, either through legitimate certificate authorities or through self-signed certificates with identifiable attributes. Certificate transparency logs, searchable through tools like crt.sh or Censys, reveal certificates issued to a domain and, critically, other domains covered by the same certificate or issued by the same account. A C2 domain that shares a wildcard certificate with three other domains immediately expands your infrastructure map.
Self-signed certificates are even more informative. The subject fields in a self-signed certificate are often reused across an operator's infrastructure. Searching Shodan or Censys for the specific certificate fingerprint or for certificates with matching subject attributes can surface additional C2 nodes the operator considers undiscovered.
Historical DNS and IP Resolution Data
Passive DNS repositories like Farsight DNSDB, RiskIQ (now part of Microsoft Defender Threat Intelligence), and the SecurityTrails API preserve historical resolution data that is unavailable through current DNS queries. A domain currently resolving to one IP may have resolved to five different IPs over the past three months. Each of those historical IPs can be pivoted against to identify co-hosted domains, which in turn may reveal campaign naming conventions, registration patterns, or additional C2 nodes.
WHOIS history, while increasingly obscured by privacy services, still yields useful data for domains registered before privacy protection became standard practice. Registrant email addresses, phone numbers, and registration date clusters can tie infrastructure together across campaigns.
JARM and TLS Fingerprinting
JARM is an active TLS fingerprinting tool developed by Salesforce that generates a fingerprint based on how a TLS server responds to a series of specially crafted client hellos. Different server configurations — specific TLS libraries, versions, cipher suite ordering — produce different JARM fingerprints. C2 frameworks that use a common server component tend to produce consistent JARM fingerprints across deployments.
Shodan indexes JARM fingerprints as part of its scanning data. If you capture the JARM fingerprint of a known C2 endpoint, searching Shodan for other hosts presenting the same fingerprint can surface the operator's broader infrastructure. The Hive kit variants and the Cavern Manticore C2 framework both present opportunities for this type of fingerprint-driven expansion because their server components are consistent across deployments even when operators modify other configuration elements.
Coordinating the Takedown Without Burning the Intelligence
The operational tension in botnet mitigation is between acting quickly to stop damage and preserving the investigation long enough to map infrastructure fully. Acting too early — blocking the first identified C2 IP and alerting the operator — collapses the investigation window. Waiting too long allows the botnet to continue operating against your environment and potentially others.
The resolution to this tension is a staged approach that separates defensive action on your own perimeter from coordinated external takedown activity.
Internal Containment First
Infected nodes within your environment can be isolated immediately without affecting the external investigation. Isolating a host at the network layer — removing it from routable segments while preserving it for forensic analysis — stops the damage without any externally visible action. The C2 operator sees the bot go silent, which is consistent with normal bot churn and does not trigger any evasion response.
Forensic analysis of the isolated host should prioritize memory acquisition before disk. Many modern botnet agents operate primarily in memory and leave minimal disk artifacts. A memory dump taken immediately after isolation captures the running agent, any decrypted configuration including C2 addresses, and potentially encryption keys or peer lists that are unavailable from disk artifacts alone.
Sinkholing
Sinkholing redirects traffic intended for a C2 domain to a controlled server, allowing defenders to observe the scale of an infection across networks they do not directly control. This is most effective when coordinated with the domain registrar or registry to redirect the domain's DNS resolution. For DGA-based botnets, registering predicted future DGA domains before the operator does — a technique called domain preregistration or DGA sinkholing — can cripple the botnet's ability to receive commands even without touching the operator's existing infrastructure.
Sinkholing data gives you a real-time view of infected IP addresses globally, which is valuable both for understanding campaign scale and for notifying affected network operators through abuse channels.
Law Enforcement and Sector Coordination
For campaigns of significant scale, coordination with law enforcement (FBI, CISA, Europol's EC3 depending on jurisdiction) and sector-specific ISACs provides access to takedown mechanisms that are not available to private defenders. The 0ktapus threat group campaign, which successfully compromised more than 130 organizations, was ultimately mapped through coordinated investigation that shared infrastructure indicators across victim organizations. Individual organizations investigating in isolation saw fragments of the same campaign; coordinated sharing produced the full picture.
The Unit 42 2026 Global Incident Response Report notes a trend toward increased automation in attacker tooling and faster deployment of compromised infrastructure, which compresses the window between initial infection and full campaign deployment. This argues for pre-established coordination relationships that can be activated quickly rather than built from scratch during an active incident.
Defensive Controls That Address the Infrastructure, Not Just the Traffic
Botnet mitigation controls that focus exclusively on blocking observed malicious traffic fail against any botnet that rotates its infrastructure faster than blocklists can be updated. The more durable approach embeds infrastructure tracking into the control layer directly.
DNS-Layer Filtering with Threat Intelligence Integration
DNS-layer security platforms (Cisco Umbrella, Infoblox BloxOne, Akamai ETP) apply threat intelligence to DNS queries in real time, blocking resolution of known C2 domains before any connection is established. The key configuration requirement is ensuring that your threat intelligence feeds are updating the DNS filter continuously rather than on a daily or hourly schedule. A fast-flux domain may be active for only minutes under any given IP; a resolver that checks its blocklist once per hour provides essentially no protection against it.
For DGA detection, DNS-layer platforms increasingly incorporate machine learning classifiers that score domain names based on lexical features without requiring a prior blocklist entry. Integrating a DGA classifier into your DNS security layer catches new DGA seeds before any threat intelligence feed has catalogued them.
Egress Filtering Based on ASN Reputation
Maintaining a continuously updated list of autonomous systems known to host botnet infrastructure or bulletproof services and applying egress filtering at that ASN level reduces the attack surface for C2 communications significantly. This is more stable than IP-level filtering because operators within a bulletproof hosting ASN rotate IPs frequently, but the ASN itself changes rarely. The operational cost is a small risk of false positives if a legitimate service co-locates within a high-risk ASN, which is manageable through exception workflows.
Several threat intelligence providers publish ASN-level reputation scores derived from historical abuse data. Integrating these into your firewall or SD-WAN policy layer enables automated ASN-based egress control that updates as the threat landscape evolves.
Endpoint-Level Beacon Detection
Deploying EDR solutions configured to alert on periodic outbound connection patterns from processes without established network communication baselines catches botnet agents that successfully evade network-layer controls by tunneling through allowed protocols. Many mature EDR platforms include behavioral rules specifically targeting beaconing patterns. Verifying these rules are enabled and tuned to your environment's baseline is a configuration step that frequently gets deferred and never completed.
For environments where full EDR deployment is constrained, host-based firewall logging on endpoints — capturing all outbound connection attempts including failed ones — provides the raw data needed for periodic beaconing analysis even without a dedicated EDR platform.
Secure Boot and Firmware Integrity
The recent disclosure of forgotten UEFI shims undermining Secure Boot is directly relevant to botnet persistence. Botnet agents that achieve firmware or pre-boot persistence survive OS reinstallation and evade endpoint security tools that load after the boot process. Auditing enrolled UEFI Secure Boot shims across your endpoint fleet and establishing a process for revoking shims associated with retired or compromised software reduces the risk of this persistence vector. Organizations that image systems as remediation without verifying firmware integrity are potentially redeploying compromised machines.
Building the Continuous Tracking Capability
Effective botnet tracking requires infrastructure that operates continuously rather than being activated in response to confirmed incidents. The following capabilities form the operational core of a sustained tracking program.
- Passive DNS collection: Running your own passive DNS sensor on critical network segments — capturing all queries and responses, not just successful ones — gives you a data set you control and can query without external API rate limits or cost constraints.
- NetFlow retention with behavioral analysis: Storing 30 days of full NetFlow data for internal segments and running periodic beaconing analysis jobs against it provides the temporal depth needed to surface low-frequency, high-jitter beacon patterns that real-time alerting cannot reliably catch.
- Threat intelligence platform with infrastructure correlation: A TIP (OpenCTI, MISP, Anomali ThreatStream) that ingests multiple feeds and correlates indicators across them lets analysts build infrastructure maps incrementally without manually cross-referencing multiple systems. Automating the enrichment pipeline — so that a new C2 IP automatically triggers certificate, passive DNS, and WHOIS lookups and stores the results in the TIP — dramatically reduces the time from initial indicator to mapped infrastructure.
- Abuse contact workflows: Pre-built templates and workflows for notifying abuse contacts at ISPs and hosting providers when you identify botnet nodes outside your network accelerate the broader ecosystem's response and build the relationships that make future coordination faster.
The botnet threat landscape rewards defenders who build tracking capabilities before incidents force them to. Operators running modified Hive kit variants, modular C2 frameworks in the Cavern Manticore model, and infrastructure seeded through compromised IoT devices like surveillance cameras are actively expanding their reach. The organizations that detect and disrupt these campaigns early share a common characteristic: they are watching the infrastructure assembly, not just the traffic it eventually generates.
