Hunt.io Report Maps 1,357 C2 Servers Across 98 Middle Eastern Providers

May 21, 2026 · Original article ↗

Summary

Hunt.io analyzed Middle Eastern infrastructure from February to May 2026, identifying 1,357 C2 servers across 98 providers. The report details provider concentrations, malware detections, and campaigns, while cautioning that tool fingerprints alone do not prove abuse.

Key points

The three-month analysis covered infrastructure in 14 countries and identified 1,357 C2 servers among 1,459 total artifacts across 98 providers.
STC accounted for 981 C2 detections, or 72.4% of the dataset; the report says this likely reflects its large subscriber network and compromised customer endpoints.
C2 detections made up 93% of observed artifacts. Other findings included 45 malicious open directories, 43 IOC Hunter posts, seven phishing sites, and seven publicly referenced IOCs.
Frequently detected tools and malware included Tactical RMM, Keitaro, Acunetix, Gophish, Mozi, and Hajime; the report notes that some tools are dual-use and detections do not establish malicious use.
Examples linked regional infrastructure to varied activity, including botnets, phishing, espionage, ransomware delivery, destructive campaigns, and exploitation of CVE-2025-11953.
Hunt.io recommends tracking provider- and network-level patterns alongside individual indicators to help defenders prioritize monitoring and response.

Article Details

Publisher: Hunt IO
Report Period: 2026-02-01 to 2026-05-01
Scope: Infrastructure detections across 98 Middle Eastern providers in 14 countries. Software fingerprints alone do not establish malicious use.
Sample Size: 1,459 recorded artifacts, including 1,357 potential C2 servers.
Key Statistics: The dataset contained 1,357 C2 detections, 45 malicious open directories, 43 IOC Hunter posts, 7 publicly reported IOCs, and 7 phishing sites.
C2 detections accounted for 93.0% of artifacts; malicious open directories accounted for 3.1%, IOC Hunter posts 2.9%, phishing sites 0.5%, and publicly reported IOCs 0.5%.
STC recorded 981 detections over 90 days, reported as 72.4% of the regional C2 total; the report considers this most consistent with compromised customer endpoints rather than provider intent.
Other leading providers recorded 111 C2 detections at SERVERS TECH FZCO, 62 at OMC, 44 at TÃ¼rk Telekom, and 38 at Regxa Company for Information Technology Ltd.
The family/tool query returned 92 unique Tactical RMM detections and 71 Keitaro detections; these dual-use software fingerprints do not independently prove malicious activity.
Recommendations: Correlate software fingerprints with resolved domains, certificate or SSH overlaps, and previously reported IP activity before assessing maliciousness.
Track hosting environments, ASNs, and recurring provider patterns to prioritize monitoring and blocking rather than relying only on frequently rotating individual indicators.

Indicators of compromise

Type	Indicator	Context
IPV4	`197[.]51[.]170[.]131`	Source IP on TE Data infrastructure associated with the AWS intrusion documented by Sysdig researchers.
IPV4	`37[.]32[.]15[.]8`	RondoDox exploitation server on AbrArvan CDN and IaaS infrastructure documented by Bitsight TRACE.
IPV4	`5[.]109[.]182[.]231`	Source IP on Mobily infrastructure observed actively exploiting CVE-2025-11953 and delivering encoded PowerShell payloads.
IPV4	`93[.]113[.]62[.]247`	IP on Netinternet Bilisim Teknolojileri AS linked to phishing impersonating Cloud Storage services to harvest payment details.
IPV4	`94[.]252[.]245[.]193`	Phorpiex (Twizt) botnet C2 server observed on Syrian Telecom infrastructure.