---
id: 6187
title: "Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers"
source_domain: hunt.io
source_url: "https://hunt.io/blog/russian-malicious-infrastructure-c2-servers-mapped"
published_at: "2026-04-15T00:00:00Z"
tags: ["threat-intelligence", "malware", "threat-hunting", "russia", "command-and-control", "hosting-providers", "host-radar"]
phying_url: "https://phying.com/item/6187"
lang: en
---

# Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers

## Summary

Host Radar mapped 1,250+ active C2 servers across 165 Russian providers over three months, with TimeWeb, REG.RU and VDSina hosting the most, and Keitaro, Cobalt Strike and Sliver among top families.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-04-15T00:00:00Z
- **Original:** https://hunt.io/blog/russian-malicious-infrastructure-c2-servers-mapped
- **Phying News:** https://phying.com/item/6187