A single telecommunications provider hosted more than three-quarters of active command-and-control servers targeting the Middle East, according to new research that is pushing security teams to rethink how they track malicious infrastructure.
Researchers at Hunt.io mapped over 1,350 C2 servers operating across the region and found that a small cluster of hosting providers underpins a significant portion of active malware campaigns. The findings suggest that threat intelligence workflows focused on individual indicators of compromise and malware signatures may be missing the broader hosting patterns that keep these campaigns running.
Concentrating malicious infrastructure within one provider gives attackers operational stability and lower costs. It also lets them blend C2 beaconing into high-volume legitimate traffic that rarely triggers traditional detection rules. For SOC teams relying on endpoint-focused alerting, malicious communications can persist undetected inside otherwise trusted networks.
The research points to a shift in how defenders should approach threat hunting. Rather than chasing isolated IOCs after a breach, teams are encouraged to map the hosting ecosystems themselves by integrating ASN tracking, IP reputation scoring, and provider-level behavioural analytics into daily monitoring.
For security teams in Asia-Pacific, the implication is clear: upstream ISP selection matters as much as endpoint hardening. Organisations should audit which providers host their external-facing services, track ASN-level trends in traffic logs, and flag anomalies when communications spike toward providers with poor abuse response records.
Speed matters when malicious infrastructure is concentrated. Security teams that can submit structured, evidence-rich takedown requests to telecom operators stand a better chance of accelerating campaign disruption. But telecoms are not traditionally structured as threat intelligence partners, and privacy regulations complicate traffic-level data sharing. Industry groups and regional CERTs could bridge this gap by standardising reporting formats and aggregating abuse data without exposing sensitive details.
Adding infrastructure-level monitoring to existing endpoint workflows risks alert fatigue if not carefully scoped. A practical approach is to prioritise ASN and IP reputation scoring for outbound traffic to regions where an organisation has no legitimate business presence, then layer deeper provider-level analytics only where baseline anomalies appear.
The findings do not suggest abandoning signature-based detection. They argue it is no longer sufficient alone. Teams that combine traditional IOC tracking with infrastructure mapping will be better positioned to identify campaigns before they scale.
根據最新研究，一家電訊供應商承載了超過四分之三針對中東地區的活躍C2（command-and-control）伺服器，這項發現正促使安全團隊重新思考如何追蹤惡意基礎設施。
Hunt.io的研究人員繪製了該地區超過1,350台C2伺服器的分佈圖，發現一小撮主機供應商支撐著大量活躍的惡意軟件活動。研究結果顯示，專注於個別IOC和惡意軟件特徵的威脅情報工作流程，可能錯過了維持這些活動運作的整體主機模式。
將惡意基礎設施集中於單一供應商，為攻擊者帶來運作穩定性和更低成本。這也讓他們能夠將C2 beaconing混入高流量的合法通訊中，而這些通訊極少觸發傳統檢測規則。對於依賴端點警報的SOC團隊而言，惡意通訊可以在本來受信任的網絡內持續存在而未被發現。
研究指出防禦者應轉變威脅狩獵的方式。研究鼓勵團隊在入侵後追趕孤立的IOC之餘，更應透過將ASN追蹤、IP信譽評分和供應商級別行為分析整合到日常監控中，繪製主機生態系統本身的分佈。
對於亞太區的安全團隊而言，啟示很明確：上游ISP的選擇與端點加固同樣重要。機構應審查哪些供應商承載其對外服務、在流量日誌中追蹤ASN級別趨勢，並在通訊量異常湧向那些處理濫用投訴記錄欠佳的供應商時發出警示。
當惡意基礎設施高度集中時，速度至關重要。能夠向電訊營運商提交結構化、證據充分的移除請求的安全團隊，更有機會加速破壞攻擊活動。但電訊商傳統上並非構建成為威脅情報夥伴，私隱法規亦令流量級別的數據共享變得複雜。業界組織和地區CERT可透過標準化報告格式和匯總濫用數據（同時不暴露敏感細節）來彌補這一缺口。
在現有端點工作流程中加入基礎設施級別監控，如不仔細界定範圍，可能會導致警報疲勞。一個務實的做法是優先為那些機構並無合法業務存在的地區的出站流量進行ASN和IP信譽評分，然後僅在出現基線異常時才加入更深層的供應商級別分析。
研究結果並非建議放棄基於特徵的檢測，而是指出單靠這種方法已不再足夠。結合傳統IOC追蹤與基礎設施繪製的團隊，將更有能力在攻擊活動擴大規模之前將其識別。