# Hunt.io maps 1,350+ C2 servers across Middle East providers

Published: 2026-06-04 · Severity: medium · Sectors: energy, telecommunications
Canonical: https://vorant.io/reports/a1fe4ba3-3f71-42cc-b457-f0e07cf73181/hunt-io-maps-1-350-c2-servers-across-middle-east-providers

> Hunt.io mapped 1,350+ C2 servers across 98 Middle East providers in Q1 2026, with Saudi Telecom hosting 72% of regional malicious infrastructure via compromised endpoints.

Between February and May 2026, Hunt.io's Host Radar module identified over 1,350 active command-and-control servers operating across 98 infrastructure providers spanning 14 Middle Eastern countries. The analysis reveals extreme concentration: Saudi Arabia's STC alone hosts 981 C2 servers (72.4% of all regional C2 infrastructure), likely through compromised customer endpoints rather than provider-hosted systems. Other significant concentrations include SERVERS TECH FZCO in the UAE (111 C2s), OMC in Israel (62), Türk Telekom (44), and Iraq's Regxa Company (38, carrying the highest bulletproof rating observed).

The malware landscape is dominated by IoT botnets (Hajime, Mozi, Mirai) and offensive frameworks (Tactical RMM, Cobalt Strike, Sliver). Tactical RMM leads with 92 unique C2 IPs, followed by Keitaro traffic distribution systems (71) used in malvertising campaigns. The research documents diverse threat activity including state-sponsored espionage (Eagle Werewolf APT targeting Iraqi infrastructure), destructive campaigns (DYNOWIPER against Polish energy via UAE hosting), sophisticated intrusions (AI-powered AWS compromise via Egyptian TE Data), and MaaS platforms (CLICKSMOKE, Needle). Multiple campaigns leveraged ClickFix social engineering techniques. The concentration of malicious infrastructure within telecommunications giants and bulletproof hosting providers demonstrates how provider-level intelligence enables proactive defense by targeting persistent hosting patterns rather than ephemeral indicators.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11953 (KEV)
- Threat actors: APT28, ENERGETIC BEAR, Eagle Werewolf, GrayCharlie, Velvet Tempest
- Malware: Amatera, AquilaRAT, AsyncRAT, Cobalt Strike, DynoWiper, EchoGather RAT, Gophish, Hajime, HellsUchecker, Keitaro, LockBit Black, Mirai, Mozi, NetSupport RAT, Phexia, Phorpiex, RondoDox, Sliver, SoullessRAT, Tactical RMM, Termite, Twizt, XMRIG

## Detection guidance (public sample)

### ClickFix-Style PowerShell Execution Spawned from Explorer via Run Dialog

ATT&CK: T1204.003

Detects PowerShell launched directly by explorer.exe with hidden window and IEX/Invoke-Expression, consistent with ClickFix social-engineering lures that trick users into pasting malicious commands into the Windows Run dialog. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ClickFix-Style PowerShell Execution Spawned from Explorer
id: 6b05dceb-728e-5c4d-93fe-77fd30e74a57
status: experimental
description: Detects PowerShell processes launched directly from explorer.exe with
  a hidden window and IEX/Invoke-Expression usage, matching the ClickFix technique
  where victims are lured into pasting attacker-supplied commands into the Run dialog.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \\explorer.exe
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
    CommandLine|contains:
    - -w hidden
    - -windowstyle hidden
    - WindowStyle Hidden
  selection_iex:
    CommandLine|contains:
    - IEX
    - Invoke-Expression
  condition: selection and selection_iex
falsepositives:
- Legitimate PowerShell shortcuts pinned to the taskbar or Start menu that use hidden
  windows
- IT-authored scripts launched manually by administrators from Explorer
level: high
tags:
- attack.t1204.003
- attack.execution
author: Vorant
```

### PowerShell Encoded Command with Hidden Window (Social-Engineering Delivery)

ATT&CK: T1059.001

Detects PowerShell invoked with -EncodedCommand combined with a hidden window flag, a pattern used by ClickFix and malvertising/TDS-driven campaigns to execute obfuscated payloads delivered through spearphishing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Encoded Command with Hidden Window Flag
id: ef82c7bb-1880-50e7-842b-8b699ee80c51
status: experimental
description: Detects PowerShell processes using -EncodedCommand together with a hidden
  window flag, matching obfuscated payload execution used in ClickFix, Keitaro TDS
  redirects, and malvertising delivery chains described in the report.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
    CommandLine|contains:
    - -enc
    - -EncodedCommand
  selection_hidden:
    CommandLine|contains:
    - -w hidden
    - -windowstyle hidden
    - WindowStyle Hidden
  filter:
    CommandLine|contains:
    - ConfigurationManager
    - Microsoft.SCCM
  condition: selection and selection_hidden and not filter
falsepositives:
- Enterprise software deployment tools that legitimately use encoded, hidden PowerShell
  invocations (e.g., SCCM, Intune remediation scripts)
- Custom automation scripts written by internal IT that intentionally hide the console
  window
level: medium
tags:
- attack.t1059.001
- attack.t1027
- attack.t1140
- attack.execution
author: Vorant
```

### Certutil Decode Used to Deobfuscate Downloaded Payload

ATT&CK: T1140

Detects certutil.exe invoked with -decode to convert a base64-encoded staged file into an executable payload, a common deobfuscation step preceding execution of C2 loaders or offensive frameworks (Cobalt Strike, Sliver, Tactical RMM) noted in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Certutil Decode Used for Payload Deobfuscation
id: 0ba10107-8b68-55ba-bab1-788cff2ce7cd
status: experimental
description: Detects certutil.exe being used with the -decode flag, a technique abused
  to deobfuscate base64-encoded payloads dropped by phishing links or TDS redirects
  before execution of second-stage malware or C2 agents.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\certutil.exe
    CommandLine|contains:
    - -decode
    - /decode
  filter:
    CommandLine|contains: certutil -decode -f
  condition: selection and not filter
falsepositives:
- Administrators using certutil for legitimate certificate management or manual file
  decoding tasks
- Automated build or deployment scripts that use certutil to decode configuration
  artifacts
level: medium
tags:
- attack.t1140
- attack.defense_evasion
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://hunt.io/blog/middle-east-malicious-infrastructure-report

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a1fe4ba3-3f71-42cc-b457-f0e07cf73181/hunt-io-maps-1-350-c2-servers-across-middle-east-providers.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup