InfoSecBulletin Cybersecurity for mankind
Hackers are using Middle East phone and internet networks more often to run big command-and-control systems. The results show a change from temporary signs to tracking at the infrastructure level, helping defenders find ongoing patterns in cyber attacks instead of just responding to changing signs of trouble.
The data shows that C2 infrastructure is the main source of bad activity in the area, making up more than 90 percent of all the items seen, much more than phishing scams, open directories, and known indicators.
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
One big finding is that a lot of activity happens in major telecom networks. The Saudi Telecom Company (STC) has 981 C2 servers, making up about 72 percent of all C2 systems found in the area.
Researchers think this focus comes from weak customer devices in the telecom network, not from a direct attack on the provider. This means that big ISP systems are being used as a way for attackers to control their systems.
Hunt.io reported to GBhackers that researchers found over 1,350 active C2 servers. These servers are spread across 98 providers in 14 countries like Saudi Arabia, the UAE, Turkey, Israel, Iran, Iraq, and Egypt.
Other well-known companies are UAE’s SERVERS TECH FZCO with over 100 C2 nodes, Israel’s OMC with more than 60, Turkey’s Türk Telekom with over 40, and Iraq’s Regxa, which has a smaller but steady presence and can handle bad activity well.
Hackers Exploit Middle East Telecoms
The presence of large telecom companies and smaller VPS providers shows how attackers fit into different network setups to stay strong and not get caught.
Host Radar found 1,459 harmful items across 98 infrastructure providers in the Middle East during three months. This includes 1,357 command and control servers, 45 bad open directories, 7 indicators of compromise in public studies, 43 IOC Hunter posts, and 7 phishing sites.
A small number of providers help create a big part of harmful infrastructure.
This clustering effect helps bad actors use the same systems, plan their actions early, and keep hidden access points ready for when they are needed. In many recorded cases, systems tied to advanced persistent threat groups were found weeks before real attacks happened.
Many types of malware seen in these networks include both common botnets and advanced tools used after an attack.
Tactical RMM, Cobalt Strike, and Sliver are tools that many people use with IoT botnets like Mirai, Mozi, and Hajime. This mix shows how cybercrime and state-related activities are using the same system.
Many offensive security tools and post-exploitation platforms are clearly seen in the dataset. These are Prism X (13), AsyncRAT (12), Sliver (10), Cobalt Strike (8), and Mirai (8). This shows that both common malware and advanced APT tools use Middle Eastern infrastructure.
Real-world campaigns linked to the infrastructure involve sending ransomware, cryptomining work, phishing efforts, and spying actions.
Researchers found Phorpiex botnet C2 servers on Syrian telecom networks. These servers sent out both cryptominers and ransomware. Other groups used telecom IP addresses to take advantage of weaknesses, use remote access trojans, and carry out attacks focused on the cloud.
The report highlights that watching infrastructure providers, self-driving systems, and hosting patterns gives a stronger defense. By paying attention to the networks often used by attackers, organizations can better predict threats, prioritize monitoring, and stop operations before they happen.
