# How Palo Alto Networks Identifies and Tracks Botnets with PuppyGraph

> Palo Alto Networks security researchers used PuppyGraph to analyze traffic logs stored in Apache Iceberg and build botnet identification and tracing functions.

- Canonical URL: https://www.puppygraph.com/case-studies/palo-alto-networks-botnet-tracking-puppygraph

## Summary

Palo Alto Networks security researchers used PuppyGraph to analyze traffic logs stored in Apache Iceberg and build botnet identification and tracing functions. The team wrote graph queries to find relationship patterns associated with compromised hosts, identified command-and-control (C2) servers and their associated victim nodes, and built a dashboard to follow their activity. Daily processing produced time series of active and new victims, allowing researchers to observe when the tracked botnets were active and when they went quiet.

## The Challenge: Finding Botnet Relationships in Large Volumes of Logs

Palo Alto Networks researchers were investigating how botnets delivered malware, which malware they delivered, and how their activity changed over time. Their work included observing attacks that exploited React2Shell, CVE-2025-55182, to deliver malware. In traffic captured in the wild, the team found a payload that retrieved a downloader, which then downloaded the actual malware.

Across their botnet investigations, the researchers needed to identify active networks and trace their associated victims. This required examining relationships in traffic logs, including patterns that could help identify compromised hosts. The team also wanted to follow the identified networks over time, tracking active C2 servers and changes in victim counts.

That research involved large volumes of log data. Examining a botnet's activity over the preceding week required processing logs across that period. Building daily trends meant continuing to process and trace activity on successive days. The researchers needed to find the relationship patterns relevant to their investigations within those logs and track the identified botnets over time.

## The Solution: Graph Queries and a C2 Tracing Dashboard

The traffic log data was stored in Apache Iceberg. PuppyGraph provided the graph query engine the team used to analyze that data and build its identification and tracing functions.

![Traffic logs stored in Apache Iceberg connect to PuppyGraph queries, which support team-built botnet identification and daily tracing. An illustrative C2 hub connects to victim nodes. Tracing follows C2 servers, victim counts, and daily active and new victims.](https://www.puppygraph.com/assets/case-studies/palo-alto-networks-yiheng/botnet-research-workflow.png)

The team built both identification and tracing functions using PuppyGraph, allowing it to investigate botnet relationships and observe daily activity.

> “We use the PuppyGraph engine to build up a series of functions. The functions include some botnet identification and tracing functionality.”
> 
> **Yiheng An**, Security Researcher, Palo Alto Networks

The researchers wrote graph queries to filter the data and find the relationship shapes they wanted to investigate. They also used specific patterns in graph query results to identify nodes that had been compromised. Those relationships provided evidence for their investigations, while PuppyGraph's engine supported the queries used to find them.

The team used PuppyGraph to visualize identified botnets. Two of its graph views showed separate groups of nodes, each with an identified C2 server at the center and victim nodes surrounding it. The views presented each server and its associated victims as a connected group.

To continue following those networks, the researchers built a tracing dashboard using PuppyGraph over the data stored in Iceberg. Each dashboard entry represented a C2 server. Researchers could follow active servers and track the number of victims associated with them.

An activity heatmap displayed active victims across dates. The team processed and traced activity every day to build time series, including daily active victims for the top ten botnets and daily new victims across the tracked botnets. The dashboard and trend views extended the analysis from identifying relationships to following activity over time.

## The Result: Identified Networks and Daily Activity Trends

The researchers identified botnets and built a workflow for continuing to trace them. Graph query results helped identify compromised nodes, while the relationship views showed identified C2 servers with their associated victims. The tracing dashboard let the team follow those servers and victim counts over time.

Daily processing provided a record of activity across dates. Researchers could examine active-victim trends for individual botnets and daily new-victim trends across the tracked networks. Those time series showed when particular botnets were active and when they were going quiet.

## Further resources

-   [The Unkillable Malware Remains Active, Bay Area Iceberg Meetup: RSA Edition, March 2026 (Palo Alto Networks presentation)](https://www.youtube.com/watch?v=QiuOz4oo_V8&t=5615s)