The Dragon’s Hub: Researchers Unmask 18,000 Malicious C2 Servers Inside China

A comprehensive architectural analysis of the malicious infrastructure within China has unearthed over 18,000 command-and-control (C2) servers distributed across 48 distinct hosting providers. This extensive dataset illuminates the symbiotic coexistence of phishing campaigns, deleterious software, and sophisticated tools orchestrated by state-sponsored adversaries within a single digital ecosystem.

The most significant concentration of this adversarial infrastructure was identified within China Unicom, where over 9,000 command nodes were detected over a three-month interval. Alibaba Cloud and Tencent followed, each hosting approximately 3,300 servers. Notably, Tencent exhibits a diverse spectrum of volatility, encompassing thousands of phishing domains and hundreds of exposed directories, suggesting its services are being leveraged for a wide variety of offensive operations.

Command-and-control servers constitute approximately 84% of the identified malicious landscape, whereas phishing represents 13%. Other artifacts, such as open directories and public indicators of compromise, contribute minimally to the overall profile. This underscores the profound reliance of modern threat actors on centralized infrastructure to orchestrate automated assaults and govern malicious software at scale.

Among the identified campaigns, specific malware lineages such as Mozi, ARL, Cobalt Strike, Mirai, and Vshell play a pivotal role, particularly in post-exploitation activities and botnet maintenance. Mozi remains preeminent, commanding over 9,000 unique IP addresses, thereby solidifying China’s status as a nexus for IoT botnet proliferation.

Furthermore, a substantial volume of these incursions is tethered to telecommunications and academic frameworks. The CERNET educational network, for instance, was implicated in campaigns exploiting the React2Shell vulnerability to disseminate cryptocurrency miners and remote access trojans. This highlights how the high-capacity networks of scientific institutions have become a prime target for exploitation.

Tencent’s infrastructure is particularly utilized for phishing maneuvers directed at users in regions such as India. These campaigns often employ deceptive sites designed to intimidate vehicle owners with fabricated legal threats regarding unpaid fines. A parallel stratagem was observed on Alibaba Cloud, where the modular Valley RAT was disseminated under the guise of official tax notifications.

Beyond these ubiquitous threats, the infrastructure of Chinese providers has been harnessed for bespoke, targeted campaigns involving advanced persistent threats (APTs). For example, IP addresses associated with BRONZE HIGHLAND were discovered on Quanzhou-based servers. Additionally, the exploitation of vulnerabilities within the Gogs system has been documented to facilitate reverse SSH access via the Supershell C2 framework.

Employing a host-centric methodology for the analysis of such threats enables practitioners to trace enduring patterns and identify the recurring nodes to which adversaries return. This approach empowers defenders to construct a strategic vanguard not merely against isolated threats, but against the entire foundational ecosystem that sustains global malicious activity.