One Telecom Provider Hosted Most of the Middle East ’s Active C2 Infrastructure
May 22, 2026 
Hunt.io mapped 1,350+ C2 servers across the Middle East, revealing how a small group of providers quietly supports major malware activity.
For years, threat intelligence focused mostly on malware families, phishing domains, and individual indicators. But a new report from Hunt.io shows why defenders may need to pay closer attention to something more boring, hosting infrastructure.
After spending roughly three months mapping malicious infrastructure across the Middle East, researchers identified more than 1,350 command-and-control servers spread across 98 providers in 14 countries. What stands out is not just the scale of the activity, but how concentrated it is.
One provider alone, Saudi Telecom Company (STC), accounted for more than 72% of all observed regional C2 activity during the period analyzed. Most of that infrastructure appears to consist of compromised customer systems rather than intentionally malicious hosting, but the result is the same: a huge amount of attacker traffic flowing through a relatively small slice of infrastructure.
“The same providers keep showing up across completely unrelated campaigns and malware families.” reads the report published by Hunt.io “Provider-level tracking beats chasing individual indicators that rotate daily.”
That’s probably the most important takeaway from the report. Attackers rotate domains, IPs, and payloads constantly. Infrastructure patterns move much more slowly.
The report also highlights how different providers tend to attract different types of activity. Türk Telekom, for example, showed the highest malware diversity in the dataset, hosting infrastructure associated with six separate malware families across multiple C2 endpoints. Researchers also flagged Regxa, an Iraqi provider, as having the highest “bulletproof hosting” profile observed in the analysis.
“Infrastructure hosted on Regxa Company for Information Technology Ltd (regxa.iq) was identified as hosting C2 associated with a February 2026 espionage campaign attributed to the Eagle Werewolf cluster, targeting state and industrial entities using Starlink registration and drone training lures.” states Hunt.io.”The multi-stage attack chain deployed EchoGather RAT via Telegram channels and phishing pages, Sliver implant via DLL side-loading through Fondue.exe, SoullessRAT via fake AlphaFly installer, and AquilaRAT (Rust backdoor) leveraging multiple rotating C2 domains.”
The malware itself is a mix of commodity tooling, botnets, phishing infrastructure, and post-exploitation frameworks. Families observed in the dataset include Cobalt Strike, AsyncRAT, Mirai, Sliver, Mozi, Hajime, Tactical RMM, and Gophish.
Some of the associated campaigns are more interesting than the malware names themselves. Hunt.io linked parts of the infrastructure to operations involving Eagle Werewolf espionage activity, DYNOWIPER attacks targeting Poland’s energy sector, and RondoDox botnet activity hosted on Iranian infrastructure.
“Saudi Arabia’s STC (Saudi Telecom Company) hosts 981 C2 servers, representing 72.4% of all detected C2 infrastructure in the region, the largest concentration observed across any single provider globally.” continues the report.
“A small set of hosting providers accounts for a disproportionate share of malicious infrastructure, with STC, SERVERS TECH FZCO (UAE), OMC (Israel), Türk Telekom, and Regxa (Iraq) hosting the largest volumes of detected C2 servers.”
That idea reflects a broader shift happening in threat hunting. Many security teams are overloaded with short-lived indicators that become useless within hours or days. Infrastructure-level analysis tends to survive longer because attackers often reuse providers, VPS environments, certificates, hosting resellers, and operational habits even when malware changes.
Another important point is that malicious infrastructure increasingly blends into legitimate environments. The report notes that much of the observed activity sits inside trusted commercial networks rather than isolated “dark” infrastructure.
That creates a difficult problem for defenders. Blocking an individual IP is easy. Blocking entire providers or regions is often impossible for operational and business reasons, especially when those networks also host legitimate customers and services.
The report doesn’t suggest that providers themselves are necessarily complicit. In many cases, attackers are abusing compromised servers or inexpensive VPS instances rented through ordinary commercial channels.
“The presence of telecommunications giants alongside cryptocurrency-accepting VPS providers within the top rankings illustrates how diverse infrastructure types, from consumer ISP networks to bulletproof hosting environments, can all be leveraged for malware C2 infrastructure deployment across the Middle East.” continues the report.
But the concentration patterns still matter because they reveal where malicious infrastructure tends to survive longest and where attackers repeatedly return.
In practical terms, the findings reinforce something many threat hunters already suspect: infrastructure telemetry often tells a more stable story than malware samples alone.
Attackers may change payloads every week. Their infrastructure habits usually change much more slowly.
“The data from this three-month window makes one thing clear: malicious infrastructure in the Middle East is not evenly distributed. Over 1,350 C2 servers across 98 providers, with a single telecom carrier accounting for nearly three quarters of all regional C2 activity, points to a threat landscape where concentration is the pattern, not the exception.” concludes the report. “Knowing which providers consistently appear in the data changes how defenders prioritize, block, and monitor.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Middle East)
