Threat Research

Recent escalations between Iran, the U.S., and Israel have coincided with increased cyber threat activity across the Middle East. Destructive incidents, including kinetic attacks affecting AWS data centers in the UAE and Bahrain, have disrupted regional cloud services....

APT28, a Russian state-sponsored threat group also known as Fancy Bear or UAC-0001, is conducting a sophisticated espionage campaign against European military and government entities. The operation primarily targets maritime and transportation organizations in Poland, Slovenia, Turkey, Greece, the UAE, and Ukraine....

Two new Android spyware campaigns, ProSpy and ToSpy, are targeting privacy-conscious users in the UAE by impersonating secure messaging apps like Signal and ToTok....

Cybercriminals in the UAE are impersonating Dubai Police to defraud consumers, using social engineering tactics such as smishing, phishing, and vishing. Victims are tricked into paying non-existent fines, including traffic tickets and license renewals, via fraudulent phone calls....

Iranian hackers are suspected of using a compromised email account from the Indian company INDIC Electronics to launch a targeted phishing campaign against UAE’s aviation and satellite communications sectors. The attack involved obfuscated malicious files and scripts, ultimately delivering a DLL backdoor, Sosano....

In fall 2024, UNK_CraftyCamel exploited a compromised Indian electronics company to target fewer than five organizations in the United Arab Emirates. The attack involved a malicious ZIP file containing multiple polyglot files, ultimately delivering a custom Go backdoor named Sosano....

Trend Micro has been monitoring Earth Simnavaz, a cyber espionage group linked to Iranian interests, which primarily targets the energy sector and critical infrastructure. Recently, there has been an uptick in cyberattacks attributed to this group, focusing on government sectors in the UAE and the Gulf region....