Hunt.io maps 1,350+ C2 servers across Middle East providers
Hunt.io mapped 1,350+ C2 servers across 98 Middle East providers in Q1 2026, with Saudi Telecom hosting 72% of regional malicious infrastructure via compromised endpoints.
Sourcehunt.io — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-11953 as exploited in the wild.
Between February and May 2026, Hunt.io's Host Radar module identified over 1,350 active command-and-control servers operating across 98 infrastructure providers spanning 14 Middle Eastern countries. The analysis reveals extreme concentration: Saudi Arabia's STC alone hosts 981 C2 servers (72.4% of all regional C2 infrastructure), likely through compromised customer endpoints rather than provider-hosted systems. Other significant concentrations include SERVERS TECH FZCO in the UAE (111 C2s), OMC in Israel (62), Türk Telekom (44), and Iraq's Regxa Company (38, carrying the highest bulletproof rating observed).
The malware landscape is dominated by IoT botnets (Hajime, Mozi, Mirai) and offensive frameworks (Tactical RMM, Cobalt Strike, Sliver). Tactical RMM leads with 92 unique C2 IPs, followed by Keitaro traffic distribution systems (71) used in malvertising campaigns. The research documents diverse threat activity including state-sponsored espionage (Eagle Werewolf APT targeting Iraqi infrastructure), destructive campaigns (DYNOWIPER against Polish energy via UAE hosting), sophisticated intrusions (AI-powered AWS compromise via Egyptian TE Data), and MaaS platforms (CLICKSMOKE, Needle). Multiple campaigns leveraged ClickFix social engineering techniques. The concentration of malicious infrastructure within telecommunications giants and bulletproof hosting providers demonstrates how provider-level intelligence enables proactive defense by targeting persistent hosting patterns rather than ephemeral indicators.
Mentioned in this report
Detection guidance
ClickFix-Style PowerShell Execution Spawned from Explorer via Run Dialog
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects PowerShell launched directly by explorer.exe with hidden window and IEX/Invoke-Expression, consistent with ClickFix social-engineering lures that trick users into pasting malicious commands into the Windows Run dialog. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ClickFix-Style PowerShell Execution Spawned from Explorer
id: 6b05dceb-728e-5c4d-93fe-77fd30e74a57
status: experimental
description: Detects PowerShell processes launched directly from explorer.exe with
a hidden window and IEX/Invoke-Expression usage, matching the ClickFix technique
where victims are lured into pasting attacker-supplied commands into the Run dialog.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\explorer.exe
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
CommandLine|contains:
- -w hidden
- -windowstyle hidden
- WindowStyle Hidden
selection_iex:
CommandLine|contains:
- IEX
- Invoke-Expression
condition: selection and selection_iex
falsepositives:
- Legitimate PowerShell shortcuts pinned to the taskbar or Start menu that use hidden
windows
- IT-authored scripts launched manually by administrators from Explorer
level: high
tags:
- attack.t1204.003
- attack.execution
author: Vorant
PowerShell Encoded Command with Hidden Window (Social-Engineering Delivery)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects PowerShell invoked with -EncodedCommand combined with a hidden window flag, a pattern used by ClickFix and malvertising/TDS-driven campaigns to execute obfuscated payloads delivered through spearphishing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PowerShell Encoded Command with Hidden Window Flag
id: ef82c7bb-1880-50e7-842b-8b699ee80c51
status: experimental
description: Detects PowerShell processes using -EncodedCommand together with a hidden
window flag, matching obfuscated payload execution used in ClickFix, Keitaro TDS
redirects, and malvertising delivery chains described in the report.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
CommandLine|contains:
- -enc
- -EncodedCommand
selection_hidden:
CommandLine|contains:
- -w hidden
- -windowstyle hidden
- WindowStyle Hidden
filter:
CommandLine|contains:
- ConfigurationManager
- Microsoft.SCCM
condition: selection and selection_hidden and not filter
falsepositives:
- Enterprise software deployment tools that legitimately use encoded, hidden PowerShell
invocations (e.g., SCCM, Intune remediation scripts)
- Custom automation scripts written by internal IT that intentionally hide the console
window
level: medium
tags:
- attack.t1059.001
- attack.t1027
- attack.t1140
- attack.execution
author: Vorant
Certutil Decode Used to Deobfuscate Downloaded Payload
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects certutil.exe invoked with -decode to convert a base64-encoded staged file into an executable payload, a common deobfuscation step preceding execution of C2 loaders or offensive frameworks (Cobalt Strike, Sliver, Tactical RMM) noted in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Certutil Decode Used for Payload Deobfuscation
id: 0ba10107-8b68-55ba-bab1-788cff2ce7cd
status: experimental
description: Detects certutil.exe being used with the -decode flag, a technique abused
to deobfuscate base64-encoded payloads dropped by phishing links or TDS redirects
before execution of second-stage malware or C2 agents.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\certutil.exe
CommandLine|contains:
- -decode
- /decode
filter:
CommandLine|contains: certutil -decode -f
condition: selection and not filter
falsepositives:
- Administrators using certutil for legitimate certificate management or manual file
decoding tasks
- Automated build or deployment scripts that use certutil to decode configuration
artifacts
level: medium
tags:
- attack.t1140
- attack.stealth
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://hunt.io/blog/middle-east-malicious-infrastructure-report
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs