{
  "Event": {
    "analysis": "1",
    "date": "2026-05-21",
    "extends_uuid": "",
    "info": "[Threat Intel] Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers",
    "protected": false,
    "publish_timestamp": "1780284559",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780284559",
    "uuid": "c40393cf-c35a-4e9c-89f7-442e9743e034",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#cf6788",
        "local": false,
        "name": "misp-galaxy:producer=\"Hunt.io\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#9c8729",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b672a4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#1cbe6b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779447606",
        "to_ids": false,
        "type": "link",
        "uuid": "d5357e8d-03c1-406b-a7b9-971a456846a9",
        "value": "https://hunt.io/blog/middle-east-malicious-infrastructure-report"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779447606",
        "to_ids": false,
        "type": "text",
        "uuid": "abd4d8de-9771-4b19-aa1d-005208fe3b4c",
        "value": "Between February and May 2026, over 1,350 active command-and-control servers were identified across 98 infrastructure providers spanning 14 Middle Eastern countries. Saudi Arabia's STC hosted 981 C2 servers, representing 72.4% of all regional malicious infrastructure, the largest concentration globally. C2 infrastructure dominated at 96.8% of detected activity, with IoT-focused botnets like Hajime, Mozi, and Mirai, alongside offensive frameworks including Tactical RMM, Cobalt Strike, and Sliver representing the primary malware families. The infrastructure supported diverse operations from state-sponsored espionage campaigns like Eagle Werewolf targeting state entities, to Malware-as-a-Service platforms, cryptomining operations, and destructive attacks such as DYNOWIPER. Key providers included SERVERS TECH FZCO in UAE, OMC in Israel, T\u00fcrk Telekom, and Regxa in Iraq, demonstrating how telecommunications giants and specialized hosting services enable both commodity cybercrime and advanced persistent threat op..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779447606",
        "to_ids": false,
        "type": "text",
        "uuid": "d2128110-bacb-4578-a5a8-4590b72b1a0d",
        "value": "Name: Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers\nAuthor: AlienVault\nAdversary: Eagle Werewolf, ENERGETIC BEAR, Velvet Tempest, APT28, GrayCharlie\nTags: [\"netsupport rat\", \"termite\", \"telecommunications\", \"asyncrat\", \"soullessrat\", \"bulletproof hosting\", \"middle east\", \"offensive frameworks\", \"phexia\", \"phorpiex\", \"xmrig\", \"twizt\", \"dynowiper\", \"echogather\", \"maas platforms\", \"c2 infrastructure\", \"tactical rmm\", \"lockbit black\", \"gophish\", \"hajime\", \"espionage campaigns\", \"sliver\", \"prism x\", \"iot botnets\", \"hellsuchecker\", \"aquilarat\", \"cobalt strike\", \"cve-2025-11953\", \"acunetix\", \"mirai\", \"keitaro\", \"mozi\", \"rondodox\"]\nTgtd countries: []\nMlwr families: [\"Phorpiex\", \"Twizt\", \"XMRig\", \"LockBit Black\", \"EchoGather\", \"Sliver\", \"SoullessRAT\", \"AquilaRAT\", \"DYNOWIPER\", \"RondoDox\", \"Mirai\", \"Phexia\", \"HellsUchecker\", \"Termite\", \"NetSupport RAT\", \"Tactical RMM\", \"Keitaro\", \"AsyncRAT\", \"Cobalt Strike - S0154\", \"Hajime\", \"Mozi\", \"Acunetix\", \"Gophish\", \"Prism X\"]\nAttack_ids: [\"T1543\", \"T1071.004\", \"T1566.001\", \"T1053\", \"T1106\", \"T1140\", \"T1190\", \"T1583.001\", \"T1036\", \"T1055\", \"T1497\", \"T1059.001\", \"T1098\", \"T1562.001\", \"T1078\", \"T1027\", \"T1573\", \"T1071.001\", \"T1136\", \"T1105\", \"T1204.001\"]\nIndustries: [\"Energy\", \"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779447606",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "c9802304-d6fb-4050-bafe-d138cdb9fc78",
        "value": "Eagle Werewolf, ENERGETIC BEAR, Velvet Tempest, APT28, GrayCharlie"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280544",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b123eca6-919f-40c9-bd50-78b5decc28f3",
        "value": "37.32.15.8",
        "Tag": [
          {
            "colour": "#d36688",
            "local": false,
            "name": "asn:asn=\"202468\"",
            "relationship_type": ""
          },
          {
            "colour": "#55e5c2",
            "local": false,
            "name": "asn:as-owner=\"ABRARVAN-AS AbrArvan CDN and IaaS\"",
            "relationship_type": ""
          },
          {
            "colour": "#4b96f6",
            "local": false,
            "name": "asn:as-country=\"IR\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"iran\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779447606",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "60137752-53b1-4c72-a94c-cfdcc250f51b",
        "value": "CVE-2025-11953"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280565",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6fef2f26-af82-473b-ba0f-e8746c591819",
        "value": "197.51.170.131",
        "Tag": [
          {
            "colour": "#3f2998",
            "local": false,
            "name": "asn:asn=\"8452\"",
            "relationship_type": ""
          },
          {
            "colour": "#7665dc",
            "local": false,
            "name": "asn:as-owner=\"TE-AS TE-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#ce8b7f",
            "local": false,
            "name": "asn:as-country=\"EG\"",
            "relationship_type": ""
          },
          {
            "colour": "#ca6ae7",
            "local": false,
            "name": "misp-galaxy:country=\"egypt\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280586",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ed28bdb1-7b66-4015-8ccd-2d66d9512d63",
        "value": "5.109.182.231",
        "Tag": [
          {
            "colour": "#116520",
            "local": false,
            "name": "asn:asn=\"35819\"",
            "relationship_type": ""
          },
          {
            "colour": "#095eae",
            "local": false,
            "name": "asn:as-owner=\"MOBILY-AS Etihad Etisalat Company Mobily\"",
            "relationship_type": ""
          },
          {
            "colour": "#7ca718",
            "local": false,
            "name": "asn:as-country=\"SA\"",
            "relationship_type": ""
          },
          {
            "colour": "#1bbfb0",
            "local": false,
            "name": "misp-galaxy:country=\"saudi arabia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280607",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ffd5eb95-b52e-4cd7-ae46-a6a0db3cee51",
        "value": "93.113.62.247",
        "Tag": [
          {
            "colour": "#26a65e",
            "local": false,
            "name": "asn:asn=\"51559\"",
            "relationship_type": ""
          },
          {
            "colour": "#9b0b72",
            "local": false,
            "name": "asn:as-owner=\"NETINTERNET Netinternet Bilisim Teknolojileri AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c8c8d",
            "local": false,
            "name": "asn:as-country=\"TR\"",
            "relationship_type": ""
          },
          {
            "colour": "#ae20ff",
            "local": false,
            "name": "misp-galaxy:country=\"turkey\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780280628",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "603a8631-e85a-4688-a787-ccc010e36e94",
        "value": "94.252.245.193",
        "Tag": [
          {
            "colour": "#c33920",
            "local": false,
            "name": "asn:asn=\"29256\"",
            "relationship_type": ""
          },
          {
            "colour": "#96374b",
            "local": false,
            "name": "asn:as-owner=\"INT-PDN-STE-AS STE PDN Internal AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#f40cd8",
            "local": false,
            "name": "asn:as-country=\"SY\"",
            "relationship_type": ""
          },
          {
            "colour": "#c009a3",
            "local": false,
            "name": "misp-galaxy:country=\"syria\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}