Sliver Threat Intelligence: Infrastructure, Trends, and Key Insights [March 2026 - May 2026]
By Threat Intelligence Unit
Overview
Sliver is an open-source, cross-platform command-and-control (C2) framework originally developed for legitimate adversary emulation and red-team operations. Since its public release in 2019, the framework has gained widespread adoption due to its flexibility, enterprise-grade capabilities, and active development.
Although designed for security professionals, Sliver has increasingly appeared in real-world cyber incidents involving ransomware groups, financially motivated threat actors, and selected state-aligned operations. Rather than serving as an initial access tool, Sliver is most commonly deployed after attackers have already compromised an environment, enabling command-and-control, lateral movement, persistence, and post-exploitation activities.
This report first introduces Sliver and its evolution, then presents infrastructure intelligence collected by Oasis Security over the past three months to provide visibility into how Sliver is deployed in real-world operations.
Understanding Sliver
What Is Sliver?
Sliver is an open-source, cross-platform adversary emulation and command-and-control framework written in Go (Golang). Originally released by Bishop Fox in 2019, it enables operators to generate implants ("slivers") that communicate with a centralized command server across Windows, Linux, and macOS environments.
Unlike traditional malware families designed for a single purpose, Sliver is a flexible post-exploitation framework capable of supporting complex offensive operations across large environments.
Supported communication protocols include:
- HTTP / HTTPS
- DNS
- mTLS
- WireGuard
In addition to these primary C2 channels, Sliver supports raw TCP connections, which are typically used for TCP-based pivots or staging rather than as a primary implant communication channel.
Its scalability, modular architecture, and support for multiple operators provide functionality commonly associated with commercial command-and-control platforms.
Note: Although Sliver is frequently abused by threat actors, it is also a legitimate framework widely used by authorized red teams and penetration testers to emulate adversary behavior and validate security controls. Consequently, the detection of Sliver alone does not necessarily indicate malicious activity; additional context is required to determine whether its use is legitimate or malicious.
Sliver Capabilities
Sliver provides a comprehensive set of post-exploitation capabilities intended for authorized security testing but equally valuable to threat actors after initial compromise.
Primary Capabilities
- Cross-platform implant generation
- Multi-operator collaboration
- Flexible command-and-control communications
- Remote shell execution
- Process injection
- Credential access
- Host discovery
- Lateral movement support
- Persistence mechanisms
- File transfer and task automation
These capabilities allow operators to maintain long-term access while adapting communications and operational workflows to different environments.
Why Threat Actors Like Sliver
Sliver has become an increasingly attractive alternative to commercial command-and-control frameworks because it combines advanced capabilities with open-source accessibility.
Enterprise Capabilities Without Licensing Costs
Historically, many threat actors relied on commercial frameworks such as Cobalt Strike. Sliver offers comparable functionality while remaining:
- Free
- Open source
- Actively maintained
- Highly customizable
- Cross-platform
Flexible Command and Control
Sliver supports multiple communication protocols, allowing operators to adapt infrastructure as defenders block domains, IP addresses, or network paths.
Strong Post-Exploitation Functionality
After gaining access to an environment, attackers frequently use Sliver to:
- Execute remote commands
- Enumerate hosts
- Access credentials
- Move laterally
- Maintain persistence
- Continue command-and-control communications
Sliver Is Usually Not the Initial Access Tool
A common misconception is that Sliver is responsible for breaching organizations.
In reality, Sliver is typically deployed after attackers have already established initial access through methods such as:
- Phishing campaigns
- Vulnerability exploitation
- Stolen credentials
- Malware loaders
- Compromised edge devices
Once deployed, Sliver provides the command-and-control capabilities necessary to manage compromised systems and expand attacker access throughout the environment.
The Evolution of Sliver
Timeline of Adoption
| Year | Milestone |
|---|---|
| 2019 | Public release by Bishop Fox |
| 2020 | Primarily adopted by red teams; Microsoft observed threat actors adopting Sliver as early as December 2020 |
| 2021 | Malicious adoption becomes more widely observed |
| 2022 | Significant increase in threat actor usage |
| 2023 | Frequently identified during ransomware investigations |
| 2024 | Established as a mainstream alternative to Cobalt Strike |
| 2025–2026 | Widely observed across cybercrime and selected state-aligned operations |
Evolution of Tradecraft
| Period | Primary Trend | Common Techniques |
|---|---|---|
| 2020–2021 | Early adoption | Discovery, shell execution |
| 2022 | Growing operational use | Beaconing, process injection, lateral movement |
| 2023–2024 | Broad cybercrime adoption | Credential theft, ransomware operations, post-exploitation |
| 2025–2026 | Mature ecosystem | Infrastructure abuse, stealthy persistence, appliance compromise |
Global Adoption
Although Sliver originated as a U.S.-developed red-team framework, adoption quickly expanded worldwide.
Today, Sliver is regularly identified in investigations involving:
- Financially motivated cybercriminal groups
- Ransomware operators
- Initial access brokers
- Selected state-aligned intrusion sets
Its widespread adoption demonstrates how open-source offensive tooling has become an integral component of the modern threat landscape.
What This Means for Defenders
The rise of Sliver reflects a broader trend in offensive security tooling: advanced capabilities are becoming increasingly accessible through open-source software.
Organizations should prioritize behavioral detection over static signatures by monitoring:
- Command-and-control communications
- Credential access attempts
- Lateral movement activity
- Persistence mechanisms
- Infrastructure changes
- Suspicious post-exploitation behavior
Because Sliver is highly customizable, infrastructure intelligence and behavioral analytics often provide greater defensive value than tool-specific detection signatures.
AGATHA Sliver Infrastructure Intelligence
Infrastructure Overview
This analysis summarizes Sliver-related infrastructure observed by Oasis Security between March 2026 and May 2026. The following sections summarize key characteristics observed across the collected dataset, including IP address distribution, top countries, top networks, and most observed ports.
IP Address Distribution
- Infrastructure activity increased significantly in May 2026, reaching a peak of 362 observed unique IP addresses
- The chart represents the monthly count of unique IP address detections, excluding repeated detections of the same IP address
Top Countries
- The United States remains the primary hosting location, indicating operators consistently favor U.S.-based infrastructure
- Germany and the Netherlands continue to serve as major European hosting hubs
- China and Hong Kong show increasing representation, which may indicate: expansion into additional cloud providers, infrastructure diversification, or increased visibility into those regions
There is no evidence of a dramatic geographic shift between March and May; instead, the infrastructure appears to be gradually diversifying while maintaining its core hosting countries.
Overall, the distribution appears evolutionary rather than disruptive, with the same major countries remaining dominant and only moderate regional adjustments over time.
Top Networks
- DigitalOcean remains the dominant hosting network, consistently accounting for the largest share (32–37%) of observed infrastructure throughout the analysis period
- Contabo and HostPapa continue to be prominent hosting networks, although both exhibit a gradual decline in activity from March to May
The presence of infrastructure across several major hosting networks suggests operators continue to diversify deployments while relying on a consistent set of trusted providers.
Top Ports
- Port 31337 remained the most frequently observed port, consistently accounting for nearly 90% of observed infrastructure throughout the analysis period
- No significant shift in port usage was observed between March and May 2026, although a small number of alternative ports were introduced
Port 31337 (pronounced "elite" in hacker culture) has long been associated with backdoors, remote administration tools (RATs), and command-and-control (C2) infrastructure. In Sliver's case, however, there is a more concrete explanation: 31337 is the default port for Sliver's multiplayer (operator) listener—the service that operators connect to when managing the C2 server—and the official Linux install script binds this listener to all network interfaces by default. Strictly speaking, this is the operator-to-server management channel rather than the implant C2 channel itself, but when left exposed it becomes a reliable fingerprinting point for internet-wide scanning.
The fact that nearly 90% of observed infrastructure listens on 31337 therefore indicates that most operators deployed Sliver using the default installation settings without restricting the multiplayer listener to localhost or applying firewall rules—leaving the default configuration exposed and fingerprintable.
Notable Findings
A large number of new Sliver C2 IPs were detected on May 24, 2026. Many of these servers shared the same ASN, indicating that the infrastructure was deployed through the same hosting provider. This aligns with a common characteristic of Sliver, where operators rapidly deploy multiple C2 servers using cloud or VPS hosting providers to improve scalability and resilience against infrastructure takedowns.
Figure 1. Timeline of Sliver C2 servers identified through AGATHA (excerpt)
Oasis Security Case Study
A cyberattack campaign primarily utilizing the open-source Sliver Command and Control (C2) framework has been identified through AGATHA. Threat intelligence confirms that the threat actors have been operating Sliver on compromised servers since mid-January 2026. By combining social engineering tactics—such as deploying decoy websites—with the exploitation of severe vulnerabilities, the group has successfully distributed Sliver malware across multiple global regions.
Vulnerability Exploitation
The group actively targeted vulnerable systems by exploiting the React2Shell vulnerability (CVE-2025-55182). This vulnerability was widely exploited in the wild shortly after its disclosure—Trend Micro reported that 145 public proof-of-concept exploits had been identified. Upon successful exploitation, the threat actors took over the servers and distributed the Sliver malware payload.
Decoy Websites Impersonating Trusted Organizations
Beyond the exploitation of React2Shell, the defining characteristic of this campaign is the actor's use of decoy websites impersonating trusted organizations. AGATHA identified attacker-created pages disguised as the Bangladesh Air Force recruitment portal and the Ubuntu Packages site, which the group used to distribute malware to unsuspecting visitors.
Figure 2. Decoy webpage impersonating the Bangladesh Air Force recruitment portal
Figure 3. Attacker-created decoy page impersonating Ubuntu Packages
Conclusion
This analysis, powered by infrastructure intelligence collected through AGATHA, identifies that Sliver infrastructure remained highly stable despite continuous infrastructure rotation between March and May 2026. While the total number of observed IP addresses fluctuated—dipping slightly in April before surging to a peak of 362 unique IPs in May—the geographic and hosting distributions showed only minor changes throughout the analysis period.
The United States consistently remained the primary hosting location, followed by established infrastructure hubs such as Germany and the Netherlands. At the hosting provider level, DigitalOcean dominated the observed infrastructure, with Contabo and HostPapa also maintaining a significant presence. Other commercial cloud and VPS providers continued to appear at lower but consistent levels, reflecting a diversified yet stable hosting strategy.
The strongest observation is that the top networks are almost entirely commercial cloud providers and VPS hosting companies.
Rather than rapidly changing geographic or provider distributions, observed infrastructure changes were primarily driven by routine IP rotation and incremental expansion (over time through small, continuous additions), enabling operators to maintain a consistent deployment model.