Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers

Between February and May 2026, over 1,350 active command-and-control servers were identified across 98 infrastructure providers spanning 14 Middle Eastern countries. Saudi Arabia's STC hosted 981 C2 servers, representing 72.4% of all regional malicious infrastructure, the largest concentration globally. C2 infrastructure dominated at 96.8% of detected activity, with IoT-focused botnets like Hajime, Mozi, and Mirai, alongside offensive frameworks including Tactical RMM, Cobalt Strike, and Sliver representing the primary malware families. The infrastructure supported diverse operations from state-sponsored espionage campaigns like Eagle Werewolf targeting state entities, to Malware-as-a-Service platforms, cryptomining operations, and destructive attacks such as DYNOWIPER. Key providers included SERVERS TECH FZCO in UAE, OMC in Israel, Türk Telekom, and Regxa in Iraq, demonstrating how telecommunications giants and specialized hosting services enable both commodity cybercrime and advanced persistent threat op...

Pulse ID: 6a0f8f36422c8adb515a9804
Pulse Link: https://otx.alienvault.com/pulse/6a0f8f36422c8adb515a9804
Pulse Author: AlienVault
Created: 2026-05-21 23:03:18

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CobaltStrike #CryptoMining #CyberCrime #CyberSecurity #Espionage #InfoSec #IoT #Israel #Malware #MalwareAsAService #MiddleEast #Mirai #OTX #OpenThreatExchange #RAT #SaudiArabia #Sliver #Telecom #Telecommunication #UAE #bot #botnet #AlienVault

Inside a Tor Backed Supply Chain Worm

A sophisticated npm supply chain attack was uncovered involving the typosquatted package crypto-javascri, designed to mimic the legitimate crypto-js library. The malware harvests npm and GitHub credentials from infected systems, hijacks maintainer accounts, and automatically republishes trojanized versions of packages under trusted identities. The final payload incorporates a weaponized Arti Tor client with credential theft, cryptomining capabilities, privilege escalation via SUID exploitation, and systemd-based persistence mechanisms. The campaign specifically targets Linux developer systems and CI/CD environments, using Tor-based command-and-control infrastructure to maintain anonymity and resilience. The attack creates significant downstream supply chain risk through its worm-like propagation model.

Pulse ID: 6a0d970b3015e77563f4a9fa
Pulse Link: https://otx.alienvault.com/pulse/6a0d970b3015e77563f4a9fa
Pulse Author: AlienVault
Created: 2026-05-20 11:12:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #CyberSecurity #GitHub #InfoSec #Java #Linux #Malware #Mimic #NPM #OTX #OpenThreatExchange #RAT #Rust #SMS #SupplyChain #Trojan #Worm #bot #AlienVault

Whatsminer P566Z P564Z power supply for M63 M63S series

For more details, please visit:https://www.zeusbtc.com/ASIC-Miner-Repair/Parts-Tools-Details.asp?ID=4026
#whatsminer #psu #powersupply #crypto #cryptomining #bitcoinmining #btcmining #asicminer #miner #zeusmining #bitcoinminer

Is your computer fan suddenly screaming for no reason? You might be a victim of cryptojacking. This happens when malicious scripts use your hardware to mine digital currency without your consent. It drains your battery and slows everything down. Check your system resources if things feel weird. Stay safe. More info here: https://gwizit.com/go/jJBfGSm

#CyberSecurity #TechTips #CryptoMining

Thermally conductive grease 8W/mk

Thermal grease gradually dries out and becomes ineffective as ASIC miners work over time and at high temperatures, leading to hashrate drops. That's why mining farm operators need to regularly inspect and replace the thermal grease on chip surfaces to ensure optimal cooling performance and mining efficiency.

#thermalpaste #asicrepair #thermalgrease #asicminer #maintenance #miningfarm #zeusmining #cryptomining #hashboard

Hackers exploit #RCE flaws in #Qinglong task scheduler for #cryptomining

https://www.bleepingcomputer.com/news/security/hackers-exploit-rce-flaws-in-qinglong-task-scheduler-for-cryptomining/

#cybersecurtiy #crypto

Hackers exploit Qinglong flaws for cryptomining deployments

Hackers are taking advantage of two major flaws in the Qinglong open-source task scheduler, CVE-2026-3965 and CVE-2026-4047, which can be combined to gain remote control of vulnerable systems. These authentication-bypass vulnerabilities affect Qinglong versions 2.20.1 and older, and have been exploited for cryptomining deployments.

https://osintsights.com/hackers-exploit-qinglong-flaws-for-cryptomining-deployments?utm_source=mastodon&utm_medium=social

#Qinglong #Cve20263965 #Cve20264047 #Cryptomining #VulnerabilityExploitation