Network telemetry correlation has uncovered 38 active C2 nodes hosting the ShadowRAT control framework across 14 bulletproof hosting providers in Eastern Europe.