Cyber defenses based on shared Indicators of Compromise (IOCs) are failing. Adversaries now weaponize the "neutral" Internet, leveraging compromised third-party infrastructure—like IoT/SOHO gear—for complex proxy networks to obfuscate Command and Control (C2) activity and evade tracking. This paper explores the evolution of adversary botnets and the critical challenge of counter-botnet operations.