Hackers Exploit Middle East Telecoms for C2 Operations

Key Takeaways

• Cybercriminals are extensively leveraging Middle Eastern telecommunications and hosting providers for sophisticated command-and-control (C2) operations.
• Over 1,350 active C2 servers were identified across 98 infrastructure providers in the region within a three-month period.
• Saudi Telecom Company (STC) hosts a staggering 72.4% of all regional C2 infrastructure, indicating widespread compromise of customer endpoints.
• A diverse range of threats, from IoT botnets and ransomware to state-sponsored espionage tools, are operating on this shared infrastructure.
• Defenders should pivot from reactive indicator-based monitoring to proactive tracking of hosting providers and network-level patterns to anticipate attacker behavior.

Widespread Abuse of Middle Eastern Telecoms for C2 Operations

A recent threat intelligence report has uncovered a significant trend: cybercriminals are systematically exploiting legitimate telecommunications networks and hosting providers across the Middle East. These trusted systems are being weaponized as command-and-control (C2) infrastructure, serving as launchpads for a broad spectrum of cyberattacks.

The report, compiled by analysts at Hunt.io, identified more than 1,350 active C2 servers spanning 98 infrastructure providers in 14 countries within the region over just three months. This extensive malicious activity includes nations such as Saudi Arabia, the UAE, Turkey, Israel, Iraq, Iran, Egypt, and Syria.

C2 Dominates Malicious Infrastructure

The scale of C2 operations is particularly alarming, constituting approximately 93% of all detected malicious activity. The remaining portion comprises exposed malicious directories, phishing sites, and other publicly documented threat indicators. Hunt.io utilized its Host Radar module to correlate C2 servers, phishing infrastructure, and open directories back to their supporting providers and network operators.

Researchers highlighted that attackers demonstrate a deliberate strategy in selecting specific hosting environments to establish their operations. The sheer volume and concentration of these malicious assets are striking, underscoring a calculated approach by threat actors.

Saudi Arabia’s STC a Major Hub for Malicious Activity

Saudi Arabia’s STC (Saudi Telecom Company) stands out in the report, accounting for 981 of the detected C2 servers. This figure represents 72.4% of all regional C2 infrastructure, marking the highest concentration observed at any single provider globally. Analysts believe this indicates a widespread compromise of customer endpoints rather than direct breaches of STC’s core server infrastructure.

The types of threats leveraging this infrastructure are highly varied, encompassing IoT-focused botnets, advanced hacking frameworks, phishing kits, ransomware delivery systems, and even tools associated with state-sponsored espionage. This diversity suggests a shared operational landscape where both financially motivated criminal groups and sophisticated nation-state actors utilize the same underlying network infrastructure.

Telecoms and Hosting Providers Under Siege

The pervasive abuse of major telecom carriers is a defining characteristic of the current threat landscape in the Middle East. Beyond STC, other significant telecommunications providers are implicated. Türk Telekom, for instance, was linked to 44 C2 servers and 6 exposed malicious directories. Notably, Türk Telekom also exhibited the highest malware diversity in the dataset, hosting 6 distinct malware families across 9 unique C2 endpoints.

In addition to large telecoms, specialized hosting providers are playing an increasingly critical role. SERVERS TECH FZCO in the UAE was associated with 111 C2 servers. Meanwhile, Regxa Company in Iraq was tied to 38 C2 servers and received the highest “bulletproof” rating among all providers in the dataset. A bulletproof rating indicates a hosting provider’s consistent pattern of slow or non-responsive actions to abuse reports, making them attractive to malicious actors.

Dominant malware families identified on these networks include Tactical RMM, with 92 unique C2 IP addresses, Keitaro traffic distribution system (71 C2 IPs), Acunetix (38 C2 IPs), and Gophish (31 C2 IPs). Furthermore, offensive frameworks like Cobalt Strike, Sliver, and AsyncRAT were also detected, confirming the presence of both commodity cybercriminals and highly sophisticated threat actors operating within this shared space.

Malicious Campaigns Observed Across the Region

The report details several active attack campaigns directly linked to this compromised infrastructure:

• The Phorpiex (Twizt) botnet was found operating on Syrian Telecom infrastructure. This botnet employs a hybrid C2 architecture, combining standard web communication with a peer-to-peer layer to deliver encrypted payloads, including an XMRig cryptocurrency miner and previously LockBit Black ransomware.
• An espionage campaign attributed to the Eagle Werewolf cluster utilized Iraqi hosting on Regxa infrastructure. Attackers deployed multiple remote access tools (RATs) via phishing lures themed around Starlink registration and drone training.
• On Saudi Arabia’s Mobily network, researchers observed active exploitation of CVE-2025-11953, a React Native CLI vulnerability. Attackers used encoded scripts to disable security tools before deploying malicious binaries.
• Iranian-hosted infrastructure was linked to the RondoDox botnet, which recorded a peak of 15,000 daily exploit attempts against internet-exposed devices.

Hunt.io emphasized that security teams should shift their defensive strategies. Instead of solely chasing individual threat indicators, a more effective approach involves monitoring hosting providers, Autonomous System Numbers (ASNs), and network-level patterns that attackers frequently reuse. This allows defenders to anticipate attacker behavior proactively rather than merely reacting to incidents after they occur.

What You Should Do

• Implement Robust Endpoint Detection and Response (EDR): Focus on detecting and preventing compromises at the endpoint level, especially for customer-facing systems that might be abused.
• Strengthen Network Segmentation: Isolate critical infrastructure and customer networks to limit the lateral movement of attackers if a compromise occurs.
• Enhance Threat Intelligence Gathering: Integrate threat intelligence feeds that focus on malicious infrastructure, including bulletproof hosting providers and frequently abused ASNs in your region.
• Regularly Patch and Update Systems: Ensure all software, especially remote management tools and publicly accessible services, are promptly patched to mitigate known vulnerabilities.
• Monitor Outbound Traffic: Pay close attention to unusual outbound network connections from your systems, as these could indicate C2 communication.
• Conduct Phishing Awareness Training: Educate users about common phishing tactics, especially those leveraging current events or popular services, to prevent initial compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.