[Q1 2026 | Intelligence Report] Global Threat Infrastructure Trends

The SANDS Lab Threat Analysis Team publishes a quarterly intelligence report based on collected information.

We aim to create a safer cyberspace by sharing malware characteristics, threat trends, and related intelligence identified through expert analysis.

More detailed information is available through the cyber threat intelligence service <CTX>.

1. Summary

This report presents a detailed analysis of 74,971 global threat indicators of compromise (IoCs) collected from December 1, 2025 to March 1, 2026. Beyond listing indicators, it uses metadata to investigate threat-group activity by time of day and cases where infrastructure default settings were left unchanged. With isolated blocking reaching its limits, the key findings are as follows.

1. Three major operating patterns revealed by hourly traffic statistics: Detailed analysis of traffic variations across 24-hour UTC logs shows infrastructure synchronized with target business environments and operator locations.

- Target-aligned concealment: Infrastructure operates only during the target country’s business hours to blend malicious communication into normal traffic. North American attacks activate from 11:00–18:00 EST, while traffic targeting China/Southeast Asia (Dcrat) spikes at 11:00 KST (10:00 CST), when local work begins.

- Manual intervention and continuous operation: Clickfix and similar threats use automated bot infrastructure with consistent hourly communication, whereas targeted threats such as CobaltStrike show spikes from direct command execution at specific times, such as 05:00, 17:00, and 22:00.

- Core global operating window: Infrastructure activity peaks during 18:00–23:00 UTC, where worldwide time zones overlap, to improve intrusion success against global targets.

2. [Analyst’s Pick] In-depth CobaltStrike analysis: Clustering 84 seemingly unrelated CobaltStrike indicators by a single certificate public-key hash exposed default settings left unchanged during automated infrastructure provisioning, revealing immature infrastructure management by the operator.

3. Operational response indicators: In addition to findings, five strategic datasets—including immediate blocking, shared-infrastructure review, and hunting indicators—are provided separately as CSV files for immediate querying or bulk import into firewalls, WAFs, SIEMs, and other security devices. They reduce analyst fatigue and establish defensive criteria directly applicable to enterprise security operations.

2. Introduction

Traditional CTI reports have often merely listed one-off indicators already invalid at collection time or emphasized attacker narratives not immediately usable in defensive devices. To move beyond this one-dimensional focus on raw data, we adopted a “meta-intelligence” strategy to extract immediately actionable defensive logic from fragmented noise.

All intelligence in this document was collected through an internal pipeline combining global multichannel threat-sensor telemetry and cross-validated reputation data during December 1, 2025–March 1, 2026. The dataset contains 74,971 unique IoCs. Rather than trusting indicators blindly, we dynamically tracked infrastructure that still supported C2 communication and payload distribution at analysis time (approximately 23.6%, 17,701 cases) versus inaccessible infrastructure (62.4%, 46,790 cases), using these groups to calculate average lifetimes.

The defining feature of this meta-intelligence research is a “metadata reuse model” extending beyond wholesale IP/domain blocking to traces even threat actors cannot conceal. Although communication endpoints are replaced as consumables, cost efficiency and automation encourage reuse of default backend configurations. We therefore traced hosting-provider (ASN) concentration and nonstandard-port diversification at the infrastructure layer, together with URI string entropy and SSL/TLS certificate SPKI hash weaknesses at the encryption layer.

The approximately 75,000 records were reorganized into campaign clusters rather than individual indicators. Analysis connected dispersed indicators into defensive logic beyond whether sensor detections existed. The resulting evasion techniques and lifecycle statistics provide a strategic roadmap for reducing analyst fatigue and designing layered defenses beyond isolated blocking.

3. Infrastructure Ecosystem

Cross-analysis of geographic location and hosting-provider distributions across this quarter’s threat indicators quantifies threat groups’ infrastructure objectives and operating trends.

3.1. High-Risk Hosting Provider Shares and Infrastructure Characteristics

Analysis of tens of thousands of active indicators revealed strong concentration: the top five hosting providers accounted for more than half of global threat infrastructure.

[Figure 1] Threat Landscape: AS Origin Composition (Top 20)

Huawei Cloud Service ranked first with 29,820 indicators, followed by CLOUDFLARENET with 8,711, Alibaba US Technology with 4,057, Hangzhou Alibaba Advertising with 2,932, and AMAZON-02 with 1,862. This extreme concentration suggests deliberate selection, rather than random infrastructure deployment, based on technical capabilities, automation convenience, and cost efficiency suited to each campaign.

To investigate this selection, we cross-analyzed a heatmap with providers on the Y axis, campaign tags on the X axis, and association density shown by color. Three major clusters reveal statistically meaningful relationships between hosting ranges and threat types.

[Figure 2] Top 20 Hosting Providers – Tag Coverage

The densest cluster directly associates Huawei Cloud and Alibaba ranges with large botnets and indiscriminate scanning. Byobc2 accounts for 99.8% of threat traffic on Huawei Cloud and 95.1% on Alibaba US. This primarily exploits convenient APIs provided by low-cost clouds: automated scripts create VPSs in bulk and discard them immediately after malicious activity. These ranges are consumed as initial botnet contact points and mass-distribution hubs requiring substantial traffic.

The second cluster links Cloudflare and AMAZON-02 to particular campaigns and frameworks, revealing concealment and reputation hijacking used to bypass detection. Clearfake accounts for 49.8% of Cloudflare threats. Actors hide origin C2 IPs behind the global CDN’s proxy functionality, preventing direct IP-based tracking. AMAZON-02 strongly overlaps with Metasploit (41.9%) and Clickfix (18.2%). By mixing malicious traffic into major public clouds with abundant business traffic, attackers make blanket blocking cause substantial false positives and reduced business availability.

The third cluster is smaller in volume but concentrated on targeted threats. Among top-20 providers, Yancy Limited and Shenzhen Tencent show dominant CobaltStrike shares of 65.0% and 57.0%. Unlike indiscriminate distribution, these environments are selectively used as tactical hosting for core backdoor control after penetration.

The heatmap demonstrates the need for differentiated, multifaceted blocking policies based on provider characteristics. In particular, avoid blanket L3/L4 IP blocking of Cloudflare and Amazon ranges abused for evasion and shared reputation. Prioritize L7 domain analysis, Host-header validation, and precise URI-path detection to preserve legitimate availability while identifying hidden threats.

3.2. Geographic Distribution of Global Threat Infrastructure

[Figure 3] Country Distribution by Tag-Derived Role

[Figure 4] Role Coverage Heatmap by Country

Cross-analysis of logical ownership, physical hosting locations, and tag-derived roles shows geographic separation by attack function. Stacked role-share bars quantify each country’s infrastructure size and composition. Indicator counts vary sharply by country, and even neighboring countries in East Asia or Western Europe show different infrastructure purposes.

Asia, particularly China, led in volume with 33,518 indicators. The role heatmap assigns 96.6% of Chinese infrastructure to high-volume botnets, suggesting a concentration on traffic-heavy scanning and DDoS rather than sophisticated penetration. Hong Kong had only 1,396 indicators, but 84.5% involved core control infrastructure, indicating a control-hub role in advanced targeted attacks. Singapore ranked third with 2,037 indicators, combining botnets (53.1%) and core control (32.0%).

North America and Europe—including the US (10,464), UK (1,936), Germany (1,736), and Netherlands (1,533)—showed higher targeted-threat shares than Asia. High-volume botnets represented only 15.5% in the US, 5.2% in the Netherlands, and 2.3% in Germany, while core control accounted for 37.0%, 34.5%, and 34.5%. Initial-access and information-theft shares were 4.9% and 4.7% in Germany, and 1.6% and 4.7% in the Netherlands. This suggests strategic use of trusted Western hosting for exfiltration and intrusion-payload hosting to bypass country-based firewall restrictions and resemble legitimate global business traffic.

Global threat infrastructure is widely dispersed, with attack roles functionally separated by country. Security teams should differentiate outbound-traffic response and hunting priorities by destination. Abnormal traffic toward Asia should be treated as potential initial infection or botnet contact for proactive blocking; concealed communication toward North America, Europe, or Hong Kong should be considered possible exfiltration or core backdoor control and connected to immediate incident response.

4. Infrastructure Lifecycles

Creation dates, first sightings, and time to network inaccessibility (MTTD) quantify infrastructure consumption patterns and dynamic operational frameworks.

4.1. Aged-Domain Tactics and Reputation Abuse

[Figure 5] Domain Aging Distribution: Registration to Malicious Activity

To study domain acquisition strategies for bypassing reputation-based detection, we measured registration-to-first-malicious-activity delays for 16,344 abused domains. Domains maintained for at least one year led with 44.6% (7,292), followed by intermediate-age domains at 34.0% (5,550) and newly created domains under 24 hours old at 21.4% (3,502).

Domain lifetimes do not follow a normal distribution centered on the median; the two extremes show very different density patterns. Although newly created domains have the smallest overall share, the day-one histogram bin has by far the highest individual concentration. Long-maintained domains are broadly distributed over time and account for nearly half the total.

This suggests a deliberate two-track strategy: short-lived operations that mass-create domains, act immediately, and discard them before detection; and long-term concealment using longstanding or compromised high-trust domains for backdoor communication to bypass reputation filtering.

The under-24-hour group accounts for 21.4% (3,502) of domains, deployed for malicious payload delivery before 24 hours had passed. Clearfake and similar campaigns registered disposable domains in bulk through DGAs or automated APIs and used them immediately, exploiting the gap before malicious history entered vendors’ reputation databases.

Intermediate domains aged 3.3 months to 2.7 years also form a substantial 34.0% (5,550). Gootloader and Vidar violin plots have thick, rounded concentrations in this range. This indicates middle-ground evasion tactics such as preregistering domains and leaving them dormant or buying recently expired domains to reuse reputation and bypass simplistic new-domain blocking.

Aged domains maintained for at least one year form the largest group at 44.6% (7,292), with periods of legitimate business use ranging from at least one year to 27 years or more. Clickfix and AsyncRAT particularly favor them. Rather than create new domains, actors compromise legitimate web servers through vulnerable CMSs or stolen credentials and establish malicious C2 beneath subdomains. This bypasses blanket new-domain blocking and hijacks accumulated trust to delay detection.

These patterns expose the limits of filtering by creation date or reputation score alone. Even longstanding trusted domains should trigger prompt detection when accompanied by anomalies such as increased URI string entropy or nonstandard-port connections. Security teams should implement combined L7 correlation logic in SIEM systems.

4.2. Infrastructure Survival Time (MTTD) and Multiple State Transitions

[Figure 6] Malware Lifecycle Analysis: Resilience vs Volume

To evaluate one-off indicators, we correlated mean time from first detection to network inaccessibility with traffic volume. The lifespan/volume scatterplot reveals statistically distinct infrastructure clusters. Byobc2, Clickfix, and Clearfake cluster in the upper right, combining very high volume with long survival. General-purpose frameworks such as Metasploit occupy the center and left: despite relatively high traffic, they are exposed quickly and become inactive within hours or days on average. Some indicators therefore lose validity almost immediately after detection, requiring selective maintenance of long-term blocklists.

[Figure 7] Lifespan Distribution of the Top 10 Threats by Volume

Averages alone cannot describe operational variation. Boxplots of the top 10 threats by volume (Lifespan Distribution of Top 10 Volume Threats) were used to examine dispersion and outliers. Clearfake, Clickfix, and Dcrat have medians (red vertical lines) above 1,400 hours and generally long survival, placing their boxes far right or across a wide range. Metasploit, CobaltStrike, and Phorpiex have medians near zero because most infrastructure is blocked early, yet many outliers (yellow dots) survive at least 2,000 hours and inflate the mean. Metasploit and Cobaltstrike show especially strong dispersion: tightly grouped boxes on the left coexist with dense bands of outliers surviving at least 2,000 hours. Detection and response should therefore be based on threat-specific lifespan dispersion rather than uniform averages.

[Figure 8] C2 Lifecycle Pattern Map: Uptime vs Downtime

Beyond lifespan distributions, infrastructure repeatedly switches between active and inactive states. The uptime/downtime scatterplot visualizes these trajectories. In the lower-left High Volatility (Short Up & Down) region, Byobc2 and Botnet appear as large yellow Heartbeat circles, clearly demonstrating rapid flapping. RAT, RemcosRAT, and SilverC2 occupy High Persistence (Long Up & Down), indicating prolonged covert operation. Green AlwaysOn circles such as formbook cluster in Rapid Rotation (Short Down, Long Up), suggesting agile operations. This flapping reflects deliberate manipulation to evade hosting thresholds or reset IP reputation, rather than physical network faults.

Lifespan variation and dynamic transitions require changes to simple IP-blocking policies. Do not immediately unblock an indicator merely because it is inactive. Introduce effective indicator half-life into SIEM management, add indicators with flapping history to dynamic blocklists, and apply at least two additional weeks of monitoring before removal as part of layered dynamic defense.

5. Attack Tactics and Evasion Techniques

This chapter analyzes how infrastructure evades network detection during communication and payload distribution, quantifying threat-group evasion patterns using dynamic port allocation and URI string complexity.

5.1. Dynamic Port Changes and Nonstandard Communication

Malware commonly disguises C2 on HTTP (80) and HTTPS (443) to pass outbound firewall policy. Some recently observed groups instead exploit environments where firewalls and IDSs limit deep packet inspection (DPI) to those ports for performance, preferring or randomly assigning nonstandard ports. We visualized telemetry to analyze their prevalence and diversity.

[Figure 9] Nonstandard vs Standard Port Usage Ratio (Top 20 + Bottom 10 Tags)

A comparison of nonstandard-to-standard traffic shows some frameworks largely avoiding standard ports. Supershell’s ratio was 188.0, or approximately 99.47% nonstandard traffic; Viper followed at 47.0 (97.91%) and Metasploit at 28.8 (96.64%). This suggests default configurations used to maintain post-intrusion backdoors while evading standard web-traffic monitoring.

[Figure 10] Port Diversity vs Nonstandard Share

To measure dynamic port diversity, the scatterplot places unique port count on the X axis, nonstandard-port share on the Y axis, and total IoCs in bubble size. Byobc2 is a clear upper-right outlier with enormous volume and approximately 16,750 unique ports. Rather than opening a few fixed ports, it uses dynamic algorithms to switch randomly across more than 25% of all available ports.

Other threats occupy the left and center. Metasploit used 645 unique ports with approximately 96% nonstandard traffic. CobaltStrike dynamically used 194 ports (about 65%), RemcosRAT 193 (about 55%), and XWorm 161 (about 25%). Although less diverse than Byobc2, rotating tens or hundreds of ports for a single-purpose backdoor clearly indicates an intent to bypass static port-based blocking.

Infrastructure is therefore operated dynamically with active mixing of standard and nonstandard ports. Security teams should supplement port-number ACLs, enable application awareness for outbound control, and adjust NGFW thresholds to block abnormal long-lived sessions or bulk packet transfers on nonstandard ports.

5.2. URI Entropy Patterns and Concealment Tactics

[Figure 11] URI Path Entropy Distribution by Tag

We calculated the complexity of URI paths used for C2 commands and payload downloads to examine identification algorithms and concealment. Violin plots show tag-specific entropy and density: higher Y values approach random strings, lower values indicate structured forms, and wider sections indicate concentration. Distribution clearly splits into upper and lower groups according to concealment objectives.

High-entropy threats use dynamic obfuscation to evade regex-based WAF signatures. Maskgramstealer, on the left, averages about 4.17 and concentrates high in the chart, reflecting many hash-like URIs such as /b5a52ebb310b65f06dd10cfe69f72363…. Coper, Amadeybot, and Stealc also cluster high and insert unpredictable random values. Even if defenders block one string, a new path is generated for the next communication, delaying detection and tracking.

Low-entropy groups instead mimic legitimate traffic. Formbook repeatedly uses short, simple paths described as under four characters, such as /og95/, /rn10/, and /b25f/, to evade heuristic abnormal-path detection. CobaltStrike in the lower right has a low median of 1.92 and uses requests such as /jquery-3.3.1.min.js to impersonate popular legitimate JavaScript libraries and blend into internal traffic.

This polarization reflects different attack-lifecycle goals. High-entropy paths mainly support one-off initial payload downloads or credential exfiltration, using random token-like paths during short sessions to prevent tracing. Low-entropy threats must persist and beacon to C2, so they mimic normal web resources to minimize visibility to network devices.

URI complexity quantifies evasion intent. Security teams should supplement simple URL blocking with URI entropy scoring in SIEMs. Legitimate cloud applications and CDNs can also produce high-entropy URIs through encrypted session tokens, so avoid single-criterion false positives. Combine URI results with high-risk hosting ranges and nonstandard-port use in multidimensional validation to identify hidden threats and support network isolation.

6. Persistence and Attacker Identification

A core CTI goal is metadata-based clustering of infrastructure relationships despite changing IPs and domains. This chapter cross-analyzes SSL/TLS Subject Public Key Information hashes (SPKI) and hourly operating statistics to group individual indicators into campaigns and quantify operators’ deployment strategies and automation.

6.1. Certificate (SPKI) Campaign Mapping and Distributed Infrastructure Tracking

Actors distribute infrastructure among cloud providers and countries to evade tracking, yet convenience and management limitations often lead to reuse of the same SSL/TLS certificates for backend channels. SPKI-based clusters are plotted by unique ASN count (X, dispersion) and unique IP count (Y, size). Each point represents one SPKI, revealing two deployment strategies.

[Figure 12] SPKI Campaign Analysis: Infrastructure Distribution

Many clusters sit at X=1, indicating provider squatting: concentration on a single host. Two Deimos SPKI clusters run 73 and 33 C2 servers, all on ZILLION-NETWORK (AS54801). Clickfix places 25 IPs on NAMECHEAP-NET (AS22612) and another 21 on AMAZON-02 (AS16509); a QuasarRAT cluster has 21 nodes on Vietnam’s FPT Telecom Company. With at least 20 C2 nodes concentrated in one ASN, individual IP blocking becomes inefficient. Security teams should adjust trust for the AS range and prioritize review of BGP/routing-layer range blocking.

Clusters farther right with high X and Y values represent distributed campaigns across clouds, preventing a single-network block from disabling the whole operation. The upper-right CobaltStrike cluster operates 79 IPs across 41 cloud ASNs in 20 countries, including the US, China, and Hong Kong. Lower-right RemcosRAT and XWorm have fewer IPs but high dispersion: 19 IPs across 13 ASNs and 9 IPs across 6 ASNs respectively.

SPKI clustering indicates that actors periodically replace IP/domain endpoints while sharing certificate assets across campaigns. Supplement IP blocking by applying SPKI hashes as direct blocking signatures in NGFW and SWG TLS decryption rules, enabling layered defenses that preemptively block reserve infrastructure and potential C2 on previously unknown IP ranges.

5.2. Hourly Operating Statistics

[Figure 13] C2 Activity Heatmap: 24-Hour Pattern

Traffic variation across 24-hour KST logs distinguishes automated operation from manual control. Hourly campaign frequency is visualized by color intensity; continuity and interruptions reveal three major operating patterns.

First is script/system-driven always-on operation. Clickfix and Clearfake, near the top, maintain consistent frequency without narrow time concentrations. Clickfix generated 2,265–2,854 communications per hour and Clearfake 1,557–2,784. This indicates deployment and communication maintained entirely by automated bots without human involvement.

Second is high volatility reflecting hands-on-keyboard intervention. CobaltStrike and Dcrat have lower overall activity but sharp spikes. CobaltStrike rose to 460 events at 05:00, 248 at 17:00, and 307 at 22:00, then dropped to 27 at 07:00. Dcrat usually produced 30–40 per hour but surged to 576 at 11:00. These irregular variations are interpreted as direct manual command execution or exfiltration within target systems.

Third is a targeted pattern synchronized with local business hours. Metasploit peaks at 76 events at 13:00 and 70 at 17:00, while dropping to 18 at noon. Dcrat’s 11:00 KST peak corresponds to 10:00 CST and 09:00 in Southeast Asia. This suggests timing communication to target companies’ working hours to mimic normal internal traffic.

Hourly statistics provide concrete monitoring criteria. Uniform round-the-clock communication should be classified as automated infection attempts and prioritized for early traffic blocking. Intermittent peaks around business hours should instead be recognized as possible manual intrusion and linked immediately to incident response (IR).

7. Analyst’s Pick: In-Depth Case Study

Profiling Default Certificates in Attack Frameworks and Assessing Infrastructure Management Maturity

7.1. Selection Rationale and Analysis Scope

A key CTI goal is to move beyond flat blocking and build proactive defenses by clustering seemingly unrelated infrastructure through metadata. This study selected the largest cluster in Q1 2026, associated with a single CobaltStrike certificate public-key hash (SPKI: 6691ce9450b4eb3d35709bbefaa63e3819c8940e8a7db70e796070e3d5cb5c93). From 84 initial indicators, an expanded dataset incorporated port and protocol branches. Analysis examines operational immaturity such as unchanged defaults across multiple actors, tracks port-state asymmetry and flapping, and proposes stronger layered defenses.

7.2. Infrastructure Dispersion and Communication Channel Profiling

[Table 1] Infrastructure scale and dispersion of the target SPKI cluster

Infrastructure sharing the target SPKI was widely dispersed. Expanding the data yielded 88 logical entities and 92 observed records, comprising 83 unique IPs and 4 domains fragmented across 44 hosting ranges. Leading ASNs were AS37963 (17) and AS45090 (9). China accounted for 40.2%, the US 15.2%, and Hong Kong 12.0%, totaling 67.4% in the top three while spanning 20 countries overall. New deployments concentrated in January 2026, at 43.5% (40 records). For backend communication, 95.7% relied on TLS over port 443, with only 4.3% using port 80 as a supplementary plaintext channel.

7.3. X.509 Certificate Structure and Infrastructure Management Maturity

Decoding the original TLS v3 certificate revealed abnormal generation patterns. The self-signed certificate assigned the dummy value 1 to fields including country (C), state/province (ST), organization (O), and common name (CN). It also had an unusually long ten-year validity period, from 2015-05-20 to 2025-05-17. These are typical features of the shared default certificate supplied with commercial penetration-testing tool CobaltStrike. Repeated use without replacement across 83 IPs and 44 heterogeneous cloud environments suggests limited infrastructure-management maturity among initial access brokers and lower-tier actors who leave TLS defaults unchanged. Watermark tags identified in 42% of indicators—cs-watermark-987654321 in 22 and cs-watermark-666666666 in 9—also corroborate copying and distribution of particular tool versions.

7.4. In-Depth State Transition and Lifecycle Analysis

[Table 2] Current infrastructure status distribution

Tracking the lifecycles and activity transitions of 92 records reveals actual maintenance patterns. Although 69.6% are currently Dead-Network, records average 12.05 state transitions, and 79.3% have mixed histories of repeated activation and deactivation. Three major patterns emerge.

[Case A] Evasion through port asymmetry on one domain: hk.zgao.top was Dead on HTTPS port 443 but simultaneously returned Alive-App on HTTP port 80 and maintained backdoor communication. This exploits separately applied port-blocking policies and shows that a single block based only on an IP or domain string cannot fully control threat availability.

[Case B] Survival differences within one cluster: Despite sharing an SPKI, api.shenzhenschool.fun remained active on both 80/443 (Alive-App/TLS), while diao.jingxiaoliandong.com and sxwa.nxjwl.com were fully inactive. Even with the same framework, survival varies sharply with individual operators’ infrastructure-management maturity.

[Case C] Extreme flapping at the observation limit: The ten leading records that reached the History limit of 50 checks showed 49 Alive/Dead transitions. Certain nodes thus remain near hosting providers’ automatic-blocking thresholds and irregularly toggle infrastructure to evade detection.

7.5. Hourly Infrastructure Activation Patterns

[Figure 14] CobaltStrike Activity Heatmap: 24-Hour Pattern

Activating C2 only at selected times reduces cloud costs and evades security scanners—a time-of-day operating tactic. We profiled actor locations and operating patterns by analyzing UTC activity for each observed CobaltStrike watermark.

The clearest pattern is automated deployment in the cs-watermark-987654321 cluster. Responses were very low from 01:00–04:00 UTC, then 398 active C2 servers appeared simultaneously at 05:00 UTC, corresponding to 08:00 Moscow time (MSK). This suggests Eastern European or Russian-based groups use automated provisioning to spin up disposable infrastructure in bulk at the start of their workday.

By contrast, the lowercase cobaltstrike-tagged cluster synchronizes activity with target business hours for concealment. Activity was lowest at 04:00–09:00 UTC (23:00–04:00 EST) and concentrated at 16:00–23:00 UTC (11:00–18:00 EST). This is interpreted as advanced OpSec that activates infrastructure only during North American targets’ working hours to blend malicious traffic into normal business communication.

A persistent pattern also maintains consistent activity throughout 24 hours. The cs-watermark-666666666 cluster appears to keep C2 continuously running through compromised unpatched legitimate web servers or bulletproof hosting, rather than dynamically creating and discarding VPSs. This reflects infrastructure preferences of the Chinese-language threat groups primarily using this cluster.

Combining these patterns reveals a global overlap from 18:00–23:00 UTC, when all watermark clusters rise or remain high. This window combines late night in Asia, afternoon in Europe, and business hours in the Americas. Initial access brokers (IABs) and large distributors appear to treat it as prime operating time, raising infrastructure activity to maximize global attack success.

7.6. Strategic Defensive Recommendations: A Layered Operating Model

Unchanged certificate defaults, complex state transitions, and time-based activation call for layered operations beyond isolated IP blocking. First apply broad detection signatures: register the key SPKI hash directly in TLS-capable SWGs and other devices to preemptively limit new C2 across cloud ranges. Then build multidimensional firewall policy objects. Extend blocking beyond IPs/domains to combined SPKI, port, and recent activity signatures, controlling asymmetric fallback communication when primary channels are blocked.

Once spatial and structural detection is established, extend it into time-series anomaly detection. Add SIEM rules monitoring abnormal session spikes synchronized with target business hours or overseas workday starts, such as 05:00 UTC. This can precisely identify concealment within business traffic and disposable infrastructure briefly deployed by scripts at selected times.

8. Response Guide Appendices

This report provides five appendix datasets based on the confidence of multichannel threat telemetry and the characteristics of defensive mechanisms. Each is optimized for a security-operations stage—blocking, monitoring, hunting, strategy, or prediction. Security teams are encouraged to apply them to internal security devices and SIEM systems using the guidance below.

[Appendix 1] Immediate Blocklist (Blocklist)

This list selects only highly confident malicious IoCs with C2 communication active (Alive) at analysis time. Major CDN and shared-cloud ranges, including Cloudflare and Akamai, are automatically excluded to prevent disruption of legitimate services from individual IP blocking. Security teams should immediately add these IPs and domains to firewall, IPS, and other blocking policies. If subsequent inbound/outbound attempts between internal systems and these indicators appear in logs, strongly suspect endpoint infection and promptly isolate and investigate forensically.

[Appendix 2] Shared Infrastructure Review List (Review_Shared_Infra)

This includes confirmed malicious activity where immediate blocking risks collateral damage or further payload validation is needed. This quarter includes many proxy nodes in Cloudflare (AS13335) and Amazon (AS16509) ranges abused to conceal the true origin. Avoid simple IP-level blocking; use the list to prioritize domain- and URL-path-based precise blocking through web application firewalls or proxies.

[Appendix 3] Tactical Hunting List (Tactical_Hunting_Active_Campaign)

This collection of real-time detection patterns and IoCs covers the latest, most actively distributed campaigns and reflects current quarterly attack tactics. Incorporate the patterns into SIEM correlation rules to block initial intrusion attempts in real time, and use them for a comprehensive retroactive hunt across firewall and DNS logs from the past three months.

[Appendix 4] Strategic Hunting List (Strategic_Hunting_Signatures)

This list captures attackers’ invariant infrastructure fingerprints even when they continually change IPs/domains to evade defenses. Signatures include certificate public-key hashes (SPKI) and specific hosting/nonstandard-port combinations (ASN+Port). Apply them to internal/external CTI platforms and SSL Inspection systems to proactively discover hidden reserve C2 servers and support strategic neutralization at scale.

[Appendix 5] Infrastructure Transition Tracking Indicators (Tactical to Strategic Promotions)

This long-term watchlist tracks reserve attack infrastructure newly built or migrating between hosting providers for future large-scale operations. Large campaign infrastructure migrations are representative cases. Beyond blocking targets, these are strategic indicators to watch for signs of upcoming attacks and proactively strengthen defenses.

※ All data reflects activity as of the extraction date (2026.03.01). The validity of [Appendix 1] in particular may change with the speed at which attackers discard infrastructure. Periodic validation and dynamic removal are recommended to avoid overloading firewalls.

Cyber threats can occur anywhere, at any time.

SANDS Lab continuously shares reports on threat relationships and IoCs identified through analysis of the latest malware, helping prevent cyber threats and build a safer digital society.