Researchers Detail DanaBot’s Multi-Tier Command Infrastructure
Summary
Team Cymru and Black Lotus Labs map DanaBot’s multi-tier C2 and management infrastructure, reporting more than 150 active C2 servers on average and Russian-linked backend systems. The article also describes the Operation Endgame II takedown.
Key points
- Researchers observed an average of more than 150 active DanaBot Tier 1 C2 servers and nearly 400 distinct C2 IPs during 2025.
- The mapped architecture relays victim traffic through multiple C2 tiers; researchers link Tier 2 and Tier 3 systems and describe distinct clusters and communication ports.
- For C2s active in the last month of the study, only about 25% had a VirusTotal detection score above zero; 65% had a score of zero and no associated malicious files.
- The researchers observed DanaBot victims in more than 40 countries. They report that about half of infections communicated with a C2 for one day and 75% lasted less than three days.
- The analysis traces management connections to Russian-linked infrastructure. Researchers note a possible link to SmartApeSG but say the observed overlap is insufficient for a firm conclusion.
- The article describes the Operation Endgame II takedown as a serious blow to DanaBot and recommends defenses including monitoring suspicious logins from residential IPs, patch management, and phishing training.
Article Details
- Attack Vectors
- Infected devices communicate with DanaBot Tier 1 C2 servers over TCP/443, with traffic typically relayed through two or three C2 tiers.
- The researchers suggest that high-profile events may be used to lure victims into downloading malicious software or opening phishing emails.
- DanaBot can route victim data through Tor rather than communicating directly with a C2 server.
- The article says DanaBot may be used to download follow-on malware such as Latrodectus or to pass access to ransomware groups.
- Defensive Notes
- Monitor network resources, maintain patch management, and provide ongoing phishing and social-engineering training.
- Monitor for weak-credential attacks and suspicious login attempts, including those originating from residential IP addresses.
- Protect cloud assets from bots attempting password spraying and block relevant indicators with Web Application Firewalls.
- Use continuously updated network-perimeter controls to block malicious traffic from interacting with corporate networks.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article reports RDP connections from management jumpboxes to DanaBot-related backend infrastructure and a host that interacted with DanaBot C2s.T1021.004 · SSHOne management jumpbox connected over SSH to another suspected DanaBot-related host.T1021.005 · VNCVNC was used in connections among the Russian management jumpboxes and other DanaBot-related infrastructure.T1090.003 · Multi-hop ProxyDanaBot can route victim data through Tor instead of sending it directly between the victim and the C2.T1105 · Ingress Tool TransferThe researchers say DanaBot operators likely use it to download follow-on malware such as Latrodectus.T1566 · PhishingThe researchers suggest high-profile events may be used to lure victims into opening phishing emails; the article does not specify the phishing delivery method.
Malware
DanabotDanaBot first emerged in 2018 as a banking trojan but has since evolved into a versatile and persistent threat. While it initially focused on financial credential theft, it is now used for a range of purposes includingLatrodectusinfostealer and malware delivery platform. It has been observed delivering other threats such as Latrodectus, which is often linked to ransomware operations. While we will not delve into DanaBot’s malware
Vendors
Tools
Countries
BrazilWhen we investigate the bot population, Black Lotus Labs and Team Cymru have found victims in over 40 countries with Brazil, Mexico, and the United States having the most.Mexicoactive in 2025, while the botnet size was relatively modest in terms of daily victims. Of these, Mexico and the United States consistently ranked among the most impacted. Its success can be partly attributedRussiaWe suspect that DanaBot is likely operated from Russia with management infrastructure originating from several IPs in residential areas of Novosibirsk, Russia and what appears to be two other threat actors accessing theUnited States2025, while the botnet size was relatively modest in terms of daily victims. Of these, Mexico and the United States consistently ranked among the most impacted. Its success can be partly attributed to its stealth; as