Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers

hunt.io | blog | #threat-intelligence | #threat-hunting | #command-and-control | #hosting-providers | #middle-east

Summary

Host Radar mapped 1,350+ active C2 servers across 98 Middle East providers in a three-month window, breaking down hosting providers, telecom networks and campaigns by country.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Inside Eastern Europe's C2 Sprawl: 3,900+ Servers and 302 Providers Mapped (Updated)
Host Radar mapped 3,900+ active C2 servers across 302 Eastern European hosting providers over three months, surfacing provider-level threat signals—updated after provider feedback.
blog · hunt.io
Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers
Host Radar mapped 1,250+ active C2 servers across 165 Russian providers over three months, with TimeWeb, REG.RU and VDSina hosting the most, and Keitaro, Cobalt Strike and Sliver among top families.
blog · hunt.io
Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs
Host Radar found 18,000+ active malware C2 servers across 48 Chinese providers, China Unicom, Alibaba Cloud and Tencent dominating; Mozi, Mirai and Cobalt Strike drive most framework-based abuse.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.
back