A — New actors 2 first observed

First seen in our collection ≠ globally new — an actor is new to Radar's MENA-scoped view, not necessarily new to the world.

B — New malware, tools & C2 frameworks 39 families · 8 live hosts

First seen in our collection ≠ globally new. Named families (B1) are entity extractions from the corpus; live C2 hosts (B2) are Shodan fingerprint matches, hosted anywhere — MENA-hosted ones badged.

Live C2 infrastructure · Shodan fingerprints, first observed in window

C — New infrastructure & lookalikes 120 · ranked by risk

First seen in our collection ≠ globally new. Newly-observed hosts, certificates and typosquats mimicking a MENA brand, ranked by risk fingerprint (0–6): base score + known-C2 cross-match (+2) + MENA relevance (+1). Impersonation candidates, not confirmed phishing.

D — Newly-targeted brands 12 brands

First seen in our collection ≠ globally new — a brand appears here the first time any impersonation candidate for it was observed inside the window, derived from section C.

New clusters 1

Bonus cross-link target — active clusters first observed in window.