AnalysisPublished 15 Jan 2026Updated 14 Feb 2026

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

Source AlienVault OTX General

Description

An analysis of Chinese hosting environments identified over 18,000 active malware command-and-control (C2) servers distributed across 48 infrastructure providers, with China Unicom hosting nearly half. The majority of malicious activity is C2 infrastructure (84%), followed by phishing (13%). Key malware families such as Mozi, ARL, and Cobalt Strike dominate C2 activity, supporting both cybercrime and state-linked operations. High-trust networks like China169 Backbone and CERNET are exploited, revealing persistent abuse patterns and infrastructure reuse across campaigns.

Impact

The widespread presence of malware C2 servers on major Chinese ISPs and cloud providers facilitates sustained command-and-control operations for various malware families, enabling cybercrime and potentially state-linked espionage activities. The exploitation of high-trust networks increases the difficulty of detection and mitigation, allowing adversaries to maintain persistent access and control over compromised systems. This infrastructure supports a broad range of malicious activities including remote access trojans, cryptomining, and advanced persistent threat tooling, posing a medium-level threat to affected networks.

Defensive guidance

No specific patch or fix is applicable as this is an infrastructure-level threat involving distributed C2 servers. Mitigation should focus on network monitoring for known C2 indicators, blocking traffic to identified malicious infrastructure, and applying threat intelligence to detect and disrupt these campaigns. Since the threat involves abuse of legitimate ISPs and cloud providers, collaboration with these providers and leveraging threat intelligence sharing platforms is recommended to enhance detection and response capabilities.

Summary

This threat report details the mapping of more than 18,000 active malware C2 servers across major Chinese ISPs and cloud providers, including China Unicom, Alibaba Cloud, and Tencent. The infrastructure supports a range of malicious activities, primarily C2 communications for malware families like Mozi, ARL, and Cobalt Strike. The coexistence of RATs, cryptominers, and APT tooling on these networks indicates a blend of cybercriminal and state-affiliated operations. The exploitation of high-trust networks such as China169 Backbone and CERNET highlights the strategic use of reputable infrastructure to maintain resilient and long-running malicious campaigns. This host-centric mapping enables improved detection and mitigation strategies by exposing infrastructure reuse and abuse patterns.

Indicators of compromise

IP addresses 12

202.120.234.163
106.126.3.56
106.126.3.78
115.190.200.230
117.72.242.9
160.202.245.232
185.245.35.68
202.120.234.124
23.177.185.39
43.247.134.215

CVEs 1

CVE-2025-8110

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Oct 2026, 21:28 UTC

MITRE ATT&CK techniques22 from threat tags

Technical details

Indicators of compromise

IP addresses 12

CVEs 1

Community reviews

Related threats