Botnet controllers increased by 32% in 2017, Spamhaus Malware Labs reports. Amazon hosted 303 C&C servers on Amazon Web Services in 2017 compared with 36 in 2016. Cybercriminals are taking advantage of legitimate cloud providers like Amazon and Google to host them. Most malware associated with botnet controllers detected in 2017 were banking Trojans, particularly Chthonic, Gozi, Heodo, TrickBot, Dridex, WormRamnit, and PandaZeuS.”]
Source: https://www.darkreading.com/cloud/aws-google-cloud-popular-home-for-botnet-controllers