12,000+ Systems Scanned Ahead Of Middle East Critical Infrastructure Attacks

Oasis Security uncovered a coordinated reconnaissance-to-exfiltration campaign active since February that scanned >12,000 internet-exposed systems, exploited five newly disclosed RCE vulnerabilities across web, mail, workflow automation, RMM, and AI platforms, and used a modular multi-protocol C2 (linked to ArenaC2/MuddyWater tradecraft) to harvest credentials and exfiltrate ~200 files (passport and payroll records) from an Egyptian aviation enterprise, with primary targeting of aviation, energy/infrastructure, and government entities in the Middle East.