A reported wave of abuse against Middle East telecom and hosting infrastructure shows why defenders are shifting from chasing single indicators to mapping the infrastructure patterns that keep command-and-control online.