◦ PUBLISHED SNAPSHOT

MENA Daily Brief — Oct 4, 2026

Published snapshot · generated Oct 4, 2026 · 08:33 UTC · 48h window

Point-in-time record of the MENA Daily Brief as computed on 2026-10-04; later intelligence is not reflected — see the live brief.

Campaigns0 new · 1 fresh activitySee all campaigns →

Correlated OSINT activity, not confirmed attribution. State-change history is not stored — "new" (first seen) and "fresh activity" (latest report) are the windowed proxies.

Warlock · SNOWLIGHT — fresh activitylatest activity 46h ago
CORROBORATED
→

Exploited in MENA0 newly relevant · 0 at P1See the full board →

Signals of MENA relevance — KEV listing, MENA OSINT mentions, ransomware leak-site activity, and tracked-actor linkage are NOT confirmed in-region exploitation. Prioritize, then verify against your own telemetry.

Quiet in this window

No freshly-mentioned or freshly-listed CVE in the last 48h out of 25 tracked. See /signals for the full board.

Ransomware3 claims · 5 over-indexingSee ransomware watch →

Leak-site claims, not confirmed breaches — metadata only.

Spirals claims a Transportation · AE targetLeak-site post · 32h ago · unverified
CLAIM
Wallstreet claims a Other · SA targetLeak-site post · 32h ago · unverified
CLAIM
rhysida claims a LB targetLeak-site post · 32h ago · unverified
CLAIM
→
CRPxO over-indexing on Financial Services14.2× lift vs. global baseline share · low confidence
OVER-INDEX
krybit over-indexing on EG12.0× lift vs. global baseline share · moderate confidence
OVER-INDEX
→
thegentlemen over-indexing on IL5.3× lift vs. global baseline share · moderate confidence
OVER-INDEX
→
qilin over-indexing on Professional Services2.6× lift vs. global baseline share · moderate confidence
OVER-INDEX
→

New & Emerging126 first observedSee new & emerging →

First appearance in our MENA collection — new to Radar, not necessarily new to the world.

179[.]43[.]170[.]151Havoc C2 · CH · first seen 22h ago
C2
→
179[.]43[.]170[.]151Havoc C2 · CH · first seen 22h ago
C2
→
13[.]61[.]179[.]31Havoc C2 · SE · first seen 22h ago
C2
→
68[.]178[.]205[.]17Havoc C2 · US · first seen 46h ago
C2
→
Saudi Aramco targeted25 lookalikes in window · aramco.com
BRAND
→
ADNOC targeted18 lookalikes in window · adnoc.ae
BRAND
→
Zain targeted12 lookalikes in window · zain.com
BRAND
→
DP World targeted10 lookalikes in window · dpworld.com
BRAND
→

KEV0 new MENA-relevantSee the full KEV list →

Newly KEV-listed and cross-referenced to a MENA actor/case. KEV listing is not confirmed in-region exploitation.

Quiet in this window

No new MENA-relevant CISA KEV entries in the last 48h out of 20 tracked. See /kev for the full catalog; this section repopulates on the next ETL run if a new entry picks up a MENA signal.

Signals7 technique spikesSee Radar Signals →

12-week technique momentum (z-score), not a 72h delta — a spike in reporting volume, not confirmed targeting.

T1133 momentum spiking2 mentions this window vs. 0 prior · z=1.63
T1133
↗
T1190.001 momentum spiking2 mentions this window vs. 0 prior · z=-0.47
T1190.001
↗
T1048 momentum spiking2 mentions this window vs. 0 prior · z=-0.47
T1048
↗
T1567.002 momentum spiking2 mentions this window vs. 0 prior · z=-0.61
T1567.002
↗
T1059.004 momentum spiking3 mentions this window vs. 2 prior · z=-0.69
T1059.004
↗
T1059 momentum spiking2 mentions this window vs. 1 prior · z=-0.72
T1059
↗

This brief covers the surfaces shipped to date. It is a routing layer, not a source — cite the underlying page (Campaigns, Exploited-in-MENA, Ransomware, Emerging, KEV, Signals) when reporting on any item above.