Measured Regional Exposure · by country

Measured from our own collection (C2 hosting, malware-distribution URLs, ransomware victim claims) — counts of measured indicators, MENA-scoped. Not adversary claims about a country; hosting country ≠ operator nationality.

The index above is one regional pressure number; this shows which countries carry the measured footprint, and of what kind — the three signals are shown split, never blended into a score.

Regional Attack Telemetry · by country

Attack share is Cloudflare Radar’s measure of DDoS/attack traffic TARGETING a country over the window, as a share of attack traffic — not incidents, victims, or confirmed impact, and it reflects only traffic Cloudflare observes.

Measured DDoS/attack traffic targeting each MENA country, from Cloudflare Radar — a network-telemetry complement to the corpus signals above (which count our own tracked infra/claims). Layer 7 (application) and Layer 3 (network) shares are shown split.

Detection coverage · MENA threat landscape

Our Sigma detection library measured against the ATT&CK techniques tracked actors actually use. Uncovered techniques split into no rule (we collect the telemetry — write the analytic) and no visibility (no sensor we use produces the data it needs — fix collection first). Corpus-wide, not your own environment.

Of 15 gaps: 11 need a rule (telemetry present) · 4 need collection first (no sensor produces the data). Visibility is inferred from what we already detect — no per-environment sensor inventory required.

Brand-impersonation watch · Certificate Transparency

Domains that mimic a MENA high-value brand but sit on a non-owned domain — from certificate transparency (CT, substring on issued certs) and registered typosquats (DNS, homoglyph/typo permutations). Impersonation candidates, not confirmed phishing. Independent of AI extraction.

Hosting via passive DNS · ⚇ = co-hosted (shares an IP with another candidate — likely the same operator).

Set your organization profile to focus this watch on your sectors — the full MENA watch is shown until then.

Active C2 infrastructure · Shodan fingerprints

Live hosts matching a known C2 / offensive-tool fingerprint (Havoc, Responder, SimpleHelp…) from public research. Global reference (C2 is hosted anywhere) — the value is cross-matching: a lookalike resolving to one of these IPs is flagged ☠ above. MENA-hosted ones badged.

C2 geography & provider concentration

Hosting country and provider are enrichment metadata, not confirmed operator attribution — and a single host on a network is not "concentration."

1 of 61 tracked malicious-infra hosts are MENA-hosted — C2/botnet infra is hosted globally; this rolls up the full footprint with the MENA-hosted subset tagged.

Infrastructure pivot hubs · Validin

IPs (from our flagged hosts + C2 references) with many co-resolved domains over time — an operator's wider footprint. Hosting-provider PTR / cloud noise is filtered. Historical association, not live proof — confirm each domain independently.

Shared-hosting clusters

Impersonation candidates resolving to the same IP, classified by hosting ASN (Censys): hosting/VPS spanning multiple brands is the stronger lead; parking and big-cloud shares are weaker (unrelated lookalikes commonly co-park there).

MENA malware IOCs · abuse.ch

Confirmed-malicious indicators tagged by malware family, from abuse.ch — ThreatFox + URLhaus(domain/URL, MENA-scoped) and Feodo (botnet C2 IPs, global high-confidence reference for cross-matching). Independent of AI extraction.

Exploited in MENA · KEV × OSINT × ransomware

Signals of MENA relevance — KEV listing, MENA OSINT mentions, ransomware leak-site activity, and tracked-actor linkage are NOT confirmed in-region exploitation. Prioritize, then verify against your own telemetry.

Priority reuses the app’s P1–P3 remediation band (see /kev) — stacked over one more signal (MENA OSINT volume) than the KEV-only page uses.

Emerging techniques

Ranked by momentum (last 4 weeks vs prior 4). z = std-devs above the 11-week baseline.