"Number of Command-And-Control Servers Spiked in 2022: Report"

The 30 percent increase in the number of unique command-and-control (C2) servers in 2022 suggests that cybercriminals and nation-state hackers are increasingly employing the machines to launch attacks. A C2 server is a computer that transmits instructions to infected devices. Typically, the servers are used to establish networks of infected devices capable of launching attacks, encrypting data, and more. Recorded Future researchers spotted more than 17,000 C2 servers in 2022, up from 13,629 the previous year. The list was dominated by Cobalt Strike team servers, botnet families such as IcedID and QakBot, and well-known Remote Access Trojans (RATs) such as PlugX, which Chinese government hackers employ. According to the researchers, botnet malware, primarily Emotet and QakBot, expanded C2 infrastructure and remained active throughout the year. The largest hosting providers, particularly Shenzhen Tencent Computer Systems in China and DigitalOcean in the US, continue to have the highest number of C2 server observations. China has, for the first time, surpassed the US as the leading country in terms of C2 server hosting volume. Recorded Future discovered C2 infrastructure on a total of 1,419 hosting providers in 116 different countries. China had over 4,000 C2 servers, followed by the US s with 3,928 and Hong Kong with 1,451. These three countries accounted for 55 percent of all the discovered C2 servers. Before it can be used maliciously, most server infrastructure is acquired through compromise or real purchases. Popular tools such as Cobalt Strike, which, according to Recorded Future, is the preferred offensive security tool for various actors, are legitimately used by red teams attempting to test corporate networks, but can be misused by criminal and nation-state hackers. This article continues to discuss the rise in the number of C2 servers in 2022. 

The Record reports "Number of Command-And-Control Servers Spiked in 2022: Report"