What does the 2026 adversary infrastructure brief cover?

How C2, phishing, and staging infrastructure is bought, burned, and reused across clusters, including bulletproof hosting, residential proxies, and certificate reuse. It is a year of workbench data, written for detection and CTI, not a press cycle. Attack Nemesis Research published it to inform blocking-versus-hunting decisions.

What do I get besides the narrative?

Which infrastructure neighborhoods to treat as durable, which to treat as noise, and the action derived from each, plus indicator tables in an appendix. Attack Nemesis pairs every infrastructure finding with an action.

Why do the brief’s indicators expire after 14 days?

Because infrastructure turns over faster than a PDF ages, and stale indicators become noisy watchlists. The expiry is deliberate. Attack Nemesis publishes indicators with a date they die.

Who is the brief for, and how long is it?

Detection engineers and CTI leads deciding what to block and what to hunt. It is a 42-page PDF brief. Attack Nemesis wrote it for the people who have to act on infrastructure, not report on it.

whitepaper · 2026-06-18 · Attack Nemesis Research

The state of adversary infrastructure, 2026

How bulletproof hosting, residential proxies, and certificate reuse actually look this year — and what that means for blocking versus hunting.

This paper is a year of the workbench: how C2, phishing, and staging infrastructure is bought, burned, and reused across clusters. It is written for detection engineers and CTI leads, not for a press cycle.

You will get the neighborhoods we consider durable, the ones we consider noise, and the actions we derived from each. Indicator tables are in the appendix and expire 14 days after publication on purpose.

Request the brief

42 pages · PDF brief. We send it to the work email you provided — no marketing sequence attached.

Questions

Common questions

What does the 2026 adversary infrastructure brief cover?: How C2, phishing, and staging infrastructure is bought, burned, and reused across clusters, including bulletproof hosting, residential proxies, and certificate reuse. It is a year of workbench data, written for detection and CTI, not a press cycle. Attack Nemesis Research published it to inform blocking-versus-hunting decisions.
What do I get besides the narrative?: Which infrastructure neighborhoods to treat as durable, which to treat as noise, and the action derived from each, plus indicator tables in an appendix. Attack Nemesis pairs every infrastructure finding with an action.
Why do the brief’s indicators expire after 14 days?: Because infrastructure turns over faster than a PDF ages, and stale indicators become noisy watchlists. The expiry is deliberate. Attack Nemesis publishes indicators with a date they die.
Who is the brief for, and how long is it?: Detection engineers and CTI leads deciding what to block and what to hunt. It is a 42-page PDF brief. Attack Nemesis wrote it for the people who have to act on infrastructure, not report on it.

Next step

See the platform against your environment.

A forty-minute briefing: your sources, your stack, and the tickets that should already exist.

Request a briefing Start a trial