Necurs, the second-most prevalent spam and malware distribution botnet, has been spotted using a fresh hiding technique to avoid detection while quietly adding more bots to its web. Necurs roughly 570,000 bots are distributed globally, with about half located in the following countries, in order of prevalence: India, Indonesia, Vietnam, Turkey and Iran. Black Lotus Labs estimates that out of those, about 90,000 are orphaned Necurs bots, meaning that they have no C2 communication.
Source: https://threatpost.com/necurs-botnet-hide-payloads/142334/