Tech Features

In the Crosshairs of APT Groups: A Feline Eight-Step Kill Chain

Published

1 year ago

June 27, 2024

By Alexander Badaev, Information security threat researcher, Positive Technologies Expert Security Center and Yana Avezova, Senior Research Analyst, Positive Technologies

In cybersecurity, “vulnerability” typically evokes concern. One actively searches for it and patches it up to build robust defenses against potential attacks. Picture a carefully orchestrated robbery, where a group of skilled criminals thoroughly examines a building’s structure, spots vulnerabilities, and crafts a step-by-step plan to breach security and steal valuables. This analogy perfectly describes the modus operandi of cybercriminals, with the “kill chain” acting as their detailed blueprint.

In a recent study, analysts from Positive Technologies gathered information on 16 hacker groups attacking the Middle East analyzing their techniques and tactics. It is worth noting that most of the threats in Middle Eastern countries come from groups believed to be linked to Iran—groups such as APT35/Charming Kitten or APT34/Helix Kitten. Let’s see how APT groups operate, how they initiate attacks, and how they develop them toward their intended targets.

Step 1: The Genesis of Intrusion (Attack preparation)

It all begins with meticulous planning and reconnaissance. APT groups leave no stone unturned in their quest for vulnerable targets. They compile lists of public systems with known vulnerabilities and gather employee information. For instance, groups like APT35 aka Charming Kitten known for targeting mainly Saudi Arabia and Israel, gather information about employees of target organizations, including mobile phone numbers, which they leverage for nefarious purposes like sending malicious links disguised as legitimate messages. After reconnaissance, they prepare tools for attacks, such as registering fake domains and creating email or social media accounts for spear phishing. For example, APT35 registers accounts on LinkedIn and other social networks to contact victims, persuading them through messages and voice calls to open malicious links.

Step 2: The Initial Access: Gaining a Foothold

Once armed with intelligence, cybercriminals proceed to gain initial access to their target’s network. Phishing campaigns, often masquerading as legitimate emails, serve as the primary means of infiltration. An example is the Desert Falcons group, observed spreading their malware through pornographic phishing. Notably, some groups go beyond traditional email phishing, utilizing social networks and messaging platforms to lure unsuspecting victims, as seen with APT35, Bahamut, Dark Caracal, and OilRig. Moreover, techniques like the watering hole method, where attackers compromise trusted websites frequented by their targets, further highlight the sophistication of these operations. Additionally, attackers exploit vulnerabilities in resources accessible on the internet to gain access to internal infrastructure. For example, APT35 and Moses Staff exploited ProxyShell vulnerabilities on Microsoft Exchange servers.

Step 3: Establishing Persistence: The Art of Concealment

Having breached the perimeter, APT groups strive to establish a foothold within the victim’s infrastructure, ensuring prolonged access and control. This involves deploying techniques such as task scheduling, as seen in the campaign against the UAE government by the OilRig group, which created a scheduled task triggering malicious software every five minutes. Additionally, many malicious actors set up malware autostart, like the Bahamut group creating LNK files in the startup folder or Dark Caracal’s Bandook trojan. Some APT groups, such as APT33, Mustang Panda, and Stealth Falcon, establish themselves in victim infrastructures by creating subscriptions to WMI events for event-triggered execution. Furthermore, attackers exploit vulnerabilities in server applications to install malicious components like web shells, which provide a backdoor for remote access and data exfiltration.

Step 4: Unraveling the Network: Internal Reconnaissance

After breaking in, APT groups don’t just sit there. They explore the system like a thief casing a house to find valuables and escape routes. This digital reconnaissance involves several steps. First, they perform an inventory check, identifying the computer’s operating system, installed programs, and updates, like figuring out a house’s security measures. For instance, APT35 might use a simple command to see if the computer is a powerful 64-bit system, capable of handling more complex tasks. Second, they map the network layout, akin to identifying valuable items and escape routes. APT groups might use basic tools like “ipconfig” and “arp” (like Mustang Panda) to see how devices are connected and communicate. They also search for user accounts and activity levels, understanding who lives in the house (figuratively) and their routines. Malicious tools, like the Caterpillar web shell used by Volatile Cedar, can list all usernames on the system. Examining running programs is another tactic, like checking for security guards. Built-in commands like “tasklist” (used by APT15 and OilRig) can reveal a list of programs currently running.

Finally, APT groups might deploy programs that hunt for secrets hidden within files and folders, like searching for hidden safes or documents. The MuddyWater group, for example, used malware that specifically checked for directories or files containing keywords related to antivirus software. By gathering this comprehensive intel, APT groups can craft targeted attacks, steal sensitive data like financial records or personal information, or exploit vulnerabilities in the system to cause even more damage.
Step 5: Harvesting Credentials: Unlocking the Vault

Access to privileged credentials is the holy grail for cyber attackers, granting them unrestricted access to critical systems and data. One common tactic is “credential dumping,” where tools like Mimikatz (used by APT15, APT33, and others) snatch passwords directly from a system’s memory, similar to stealing a key left under a doormat. Keyloggers, used by APT35 and Bahamut for example, acts like a hidden camera, silently recording keystrokes to capture usernames and passwords as victims type them in.

These stolen credentials grant access to even more sensitive areas. APT groups also exploit weaknesses in how passwords are stored. For instance, some target the Windows Credential Manager (like stealing a notepad with written down passwords). Brute-force attacks, trying millions of combinations, can crack weak passwords. Even encrypted passwords can be vulnerable if attackers have specialized tools. By employing these tactics, APT groups bypass initial security and access sensitive information or critical systems.

Step 6: Data Extraction: The Quest for Valuable Assets

Once inside, APT groups aren’t shy about snooping around. They leverage stolen credentials to capture screenshots, record audio and video (like hidden cameras and microphones), or directly steal sensitive files and databases. For instance, the Dark Caracal group employed Bandook malware, which can capture video from webcams and audio from microphones. This stolen data becomes their loot.

To ensure a smooth getaway, APT groups often employ encryption and archiving techniques. Imagine them hiding their stolen treasure chests—the Mustang Panda group, for example, encrypted files with RC4 and compressed them with password protection before shipping them out. This makes it difficult for defenders to identify suspicious activity amongst regular network traffic.

Step 7: Communication Channels: Establishing Control

APT groups rely on hidden communication channels with command-and-control (C2) servers to control infected machines and exfiltrate data. They employ various tactics to blend in with regular network traffic. This includes using common protocols (like IRC or DNS requests disguised as legitimate web traffic) and encrypting communication for further stealth.

However, some groups take it a step further. For instance, OilRig used compromised email servers to send control messages hidden within emails and then deleted them, making their C2 channel nearly invisible. These innovative techniques make it difficult for security measures to detect malicious activity, highlighting the importance of staying informed about evolving APT tactics.

Step 8: Covering Tracks: Erasing Digital Footprints

As the operation ends, APT groups meticulously cover their tracks to evade detection and prolong their presence in the compromised environment. Techniques like file obfuscation, masquerading, and indicator removal are employed to erase digital footprints and thwart forensic investigations. For example, the Bahamut group used icons mimicking Microsoft Office files to disguise malware, and the OilRig group used .doc file extensions to make malware appear as office documents. The Moses Staff group named their StrifeWater malware calc.exe to make it look like a legitimate calculator program.

To further bypass defenses, attackers often proxy the execution of malicious commands using files signed with trusted digital certificates. The APT35 group used the rundll32.exe file to execute the MiniDump function from the comsvcs.dll system library when dumping the LSASS process memory. Meanwhile, the Dark Caracal group employed a Microsoft Compiled HTML Help file to download and execute malicious files. Many APT groups also remove signs of their activity by clearing event logs and network connection histories, and changing timestamps. For instance, APT35 deleted mailbox export requests from compromised Microsoft Exchange servers. This meticulous cleaning makes it much more difficult for cybersecurity professionals to conduct post-incident investigations, as attackers often remove their arsenal of software from compromised devices after achieving their goals.

Conclusion: A Call to Vigilance

In a nutshell, the threat landscape in the Middle East is fraught with peril, as APT groups continue to refine their tactics and techniques to evade detection and wreak havoc on unsuspecting organizations. By understanding the anatomy of cyber intrusions and remaining vigilant against emerging threats, organizations can bolster their defenses and mitigate the risks posed by these sophisticated adversaries. Together, let us remain steadfast in our commitment to safeguarding the digital frontier against cyber threats.

Research Link

Tech Features

Yango Tech: Four Game-Changing Tools Revolutionising Retail Operations

Published

8 hours ago

October 30, 2025

Integrator Web-Admin

A wide angle shot of a robotic arm by Yango Tech in an industrial setup

Consumer demand in the Middle East is rising fast, driven by omnichannel shopping habits and the expectation of speed and accuracy. AI-powered automation has become essential for retailers to keep up. McKinsey projects AI contribute up to $150 billion to GCC economies by 2030, while the UAE’s retail sector is forecast to reach $74.87 billion by 2028. Yango Tech has outlined four key tools retailers can use to succeed in this environment.

1. AI Agents

AI agents are transforming retail with several capabilities. On the front end, they deliver contextually relevant recommendations in real time, tailoring offers based on location, cultural moments, or the weather, while conversational AI enriches the journey with human-like assistance in native languages. They also harness predictive capabilities by analysing unstructured data, from social media to past purchase behaviour, to anticipate shifts in demand and refine pricing or promotional strategies. Ahead of Eid Al-Adha, for instance, they might spotlight premium meat cuts or traditional Arabic sweets, helping retailers unlock revenue increases of 10–15%.

Beyond customer-facing roles, AI agents drive efficiency behind the scenes. Procurement agents compose RFPs, compare vendor offers, and execute sourcing decisions directly in procurement systems, saving up to 80% of manual effort. Replenishment agents forecast inventory gaps, adjust orders dynamically, and use computer vision to redistribute stock or reroute deliveries, boosting accuracy to 95% and cutting waste. Content management agents accelerate time-to-listing by auto-generating product cards, adapting content to trends, and ensuring consistency across markets. Pricing agents track competitor SKUs and demand elasticity in real time, optimising promotions and delivery fees to protect margins while sustaining competitiveness.

2. Smart Price Tags

Price intelligence has become crucial for staying competitive with today’s informed and price-sensitive shoppers. Dynamic pricing algorithms can review millions of products in minutes, optimising strategies at a speed human decision-making cannot match. By applying ML to track competitor pricing, market trends, and demand elasticity, retailers can adjust prices in real time, boosting gross merchandise value by up to 20%. These systems also factor in seasonal shifts, fluctuating supply costs, and product shelf life, while surge pricing AI manages delivery fees or order values during peak periods to protect margins. Digital twin technology strengthens this further by creating virtual replicas of stores, streaming data from sensors and cameras into pricing systems. This real-time visibility into shelves and product movement ensures that pricing decisions are tied directly to availability, enabling retailers to reduce waste, streamline operations, and maintain customer trust while driving profitability.

3. Computer Vision

Computer vision (CV) is redefining how retailers manage store layouts and product assortments by moving beyond static, manually updated plans. Instead of relying only on historical sales data, AI agents equipped with CV analyse real-time customer traffic and interactions to continuously optimize shelf arrangements and product placement. This creates store environments that adapt dynamically to shopper behaviour, boosting sales and improving the overall experience. CV also provides granular insights into store-specific conditions, from equipment to layout constraints, enabling smarter decisions. Beyond the shop floor, warehouses use CV to monitor dispatch accuracy, logistics teams track the condition of trucks in transit, and managers can oversee staff performance in real time. Paired with augmented reality, the technology also delivers richer customer engagement, allowing shoppers to virtually try on clothes or visualize furniture directly in their homes.

4. Robotic automation

Robotics is moving from concept to necessity in retail. In warehouses, robotic pickers trained through behavioural cloning by human experts and thousands of real-world warehouse scenarios reach up to 95% picking accuracy. With the repetitive warehouse tasks taken over, staff can focus on higher-value work and boost productivity.

Autonomous delivery robots are also emerging as practical solutions for dense urban areas. Equipped with high-precision navigation, they operate 24/7 and cut emissions compared to traditional vehicles. They complement existing fleets by reaching locations where larger vehicles cannot, supporting zero-emission urban logistics. As battery technology and urban infrastructure advance, their role in retail operations will continue to expand.

Tech Features

From Control to Intelligence: Why the GCC Is Poised to Lead the Next Security Evolution

Published

1 week ago

October 21, 2025

Integrator Web-Editor

By Wei Huang, Chief Technology Officer, Anomali

In cybersecurity, each era is defined by a shift in architecture. Firewalls dominated the 2000s. Endpoint protection and identity controls shaped the 2010s. Today, we are entering a new phase — one where cloud-native platforms, real-time data correlation, and AI-powered analytics are no longer optional but essential.

Nowhere is this transition more timely than in the Gulf Cooperation Council (GCC) region. As cloud adoption accelerates across the United Arab Emirates (UAE), Saudi Arabia, and neighboring states, national cybersecurity resilience has become a critical pillar of digital transformation. GCC organizations have a unique opportunity to leap ahead — bypassing legacy limitations and adopting next-generation security architectures purpose-built for today’s advanced threats.

The Core Shift: Security Is Now a Data Problem

For decades, cybersecurity focused on control: firewalls, proxies, endpoint agents, and network gateways. While these tools remain foundational, today’s adversaries have evolved. Attackers exploit gaps between systems, bypass controls through misconfigurations, and evade siloed defenses with increasing sophistication.

The result is a fundamental architectural shift: modern security is no longer solely about enforcing control — it’s about processing data. Effective defense requires ingesting, normalizing, and correlating telemetry across every layer of the enterprise: endpoints, cloud workloads, SaaS platforms, identity systems, and external intelligence feeds. When combined with AI-powered analytics, this data-driven approach transforms raw telemetry into actionable insights, allowing defenders to outpace attackers, rather than merely react, once an attack has been detected.

Cloud-Native Design: The Architecture That Scales

Traditional security information and event management (SIEM) systems and on-premises platforms struggle to meet the scale, flexibility, and speed required in modern hybrid environments. Cloud-native architectures, by contrast, offer elastic scalability that aligns directly with national digital transformation priorities across the GCC.

However, the scale of telemetry introduces new challenges. Global cloud storage volumes are projected to reach 100 zettabytes by the end of 2025. Storing and processing such massive datasets can quickly become prohibitively expensive — unless managed with modern design principles.

The solution lies in the security data lake: a unified, long-term, cloud-native repository capable of retaining years of structured and unstructured security data. Unlike legacy systems limited to weeks or months of visibility, a security data lake enables continuous historical analysis for threat hunting, compliance, and investigations.

Crucially, modern architectures decouple storage and compute. Instead of permanently allocating compute resources (as most legacy platforms do), serverless designs apply compute power only when needed, dramatically reducing cost while enabling faster analysis.

For example, by leveraging serverless infrastructure on Amazon Web Services (AWS), Anomali enables compute bursts across thousands of nodes, delivering correlations and searches up to 1,000 times faster, at a fraction of the cost of traditional solutions. This approach is particularly aligned to national resilience goals, where speed and efficiency are essential.

Real-Time Correlation at Petabyte Scale

Today’s attackers automate their reconnaissance, probing continuously for vulnerabilities across every layer of the enterprise. To keep pace, organizations must reduce detection time and response costs, which demands real-time correlation across petabytes of data.

By integrating telemetry from multiple domains — including firewalls, endpoints, SaaS platforms, identity providers, and threat intelligence — organizations gain visibility into attacks that no single control would detect alone. For GCC enterprises expanding hybrid and multi-cloud infrastructures, the ability to correlate across these diverse sources in real time is mission-critical.

AI Delivers Context, Not Just Alerts

Artificial intelligence is now widely marketed in cybersecurity, but much of it offers opaque conclusions without transparency — effectively adding noise rather than clarity.

True AI-powered defense must provide explainability. Anomali applies chain-of-thought (CoT) AI reasoning, ensuring every detection includes the rationale, evidence, and audit trail behind each decision. This transparency builds analyst confidence and accelerates skill development, particularly valuable as GCC nations continue building local cybersecurity talent and operational maturity.

Intelligence Closes the Gaps Left by Controls

Even with modern defenses in place, critical gaps remain. Studies show that many endpoint detection and response (EDR) solutions still miss up to 30% of advanced threats, thanks to sophisticated evasion techniques, configuration gaps, or partial visibility. Firewalls suffer similar challenges: misconfigurations and limited context allow adversaries to slip past perimeter defenses.

This is where intelligence plays a decisive role. By unifying diverse telemetry and correlating billions of daily security events, modern security analytics platforms fill these blind spots, delivering full-spectrum detection across hybrid environments. For critical infrastructure, financial institutions, and government entities in the GCC, closing these gaps is no longer optional — it is a resilience imperative.

Agentless, Serverless, Effortless

Managing thousands of endpoint agents introduces complexity, operational risk, and resource overhead. Cloud-native platforms eliminate much of this friction by integrating directly with cloud platforms, SaaS services, and enterprise infrastructure via secure APIs, allowing telemetry ingestion without deploying additional agents.

For organizations balancing hybrid complexity with cloud-first strategies, agentless deployment models dramatically simplify operations — enabling faster rollout, lower risk, and greater agility.

Why the GCC Is Uniquely Positioned to Lead

The UAE, Saudi Arabia, and neighboring GCC nations are investing heavily in smart cities, digital economies, and next-generation public services. These national ambitions require security platforms that are scalable, adaptive, intelligent, and capable of evolving alongside rapid technological change.

Cloud-native, AI-powered, intelligence-driven security operations are no longer a distant vision but an operational necessity. By embracing these architectures, GCC enterprises and governments are positioned not only to meet today’s security demands, but to set a global standard for the future of cyber defense.

The time to shift from fragmented controls to unified intelligence is now. The future of security isn’t about deploying more tools — it’s about building smarter platforms.

And the GCC is ready.

Wei Huang is the Chief Technology Officer at Anomali, a global leader in intelligence-driven cybersecurity solutions.

Tech Features

Shure’s Growth Story in the Middle East and Beyond

Published

1 month ago

September 30, 2025

Integrator Web-Admin

As the region accelerates its digital and cultural transformation, professional audio will only grow in importance.

By Yassine Mannai, Associate Director Sales, Shure MEA

A portrait of Yassine Mannai, associate director sales, Shure MEA — Yassine Mannai, Associate Director Sales, Shure MEA

The Middle East and Africa (MEA) region is witnessing an extraordinary moment of profound transformation as nations continue to reimagine their respective economies. Cities across this vibrant region are increasingly positioning themselves as global hubs, anchored on rapid technological shifts. From national diversification agendas such as Saudi Arabia’s Vision 2030 to the UAE’s expanding cultural economy and Africa’s urbanization, the region is rethinking how it communicates, collaborates, and entertains. Against this backdrop, professional audio integration has emerged as the key enabler. Pro audio is no longer viewed as luxury; it has become a strategic pillar of productivity, culture, and trust.

For Shure, this represents fertile ground for growth. The company’s trajectory in the region is anchored on a clear multi-prong approach: sustainable value creation through localization, strong partnerships, and continuous education. Rather than chasing short-term wins, the focus is on building strong ecosystems where audio technology empowers organizations to achieve their ambitions.

A Partner in Regional Growth

Demand for professional audio is being fueled by three key drivers. First, the large-scale investments in infrastructure and cultural projects trend in the region is creating an appetite for reliable, scalable audio solutions. Second, with hybrid work and learning still active, audio systems now serve as must-have tools for collaboration, ensuring clarity and engagement. Third, the entertainment and events industry continues to flourish, with audiences expecting immersive sound experiences with emotional connection.

Shure’s presence in conferences, cultural centers, and classrooms underscores its adaptability. By aligning closely with each sector’s needs, the company is not just supplying equipment – it is shaping how people experience communication and culture. Providing the ultimate IT and meeting room solutions is one thing, ensuring that end-user requirements in meeting spaces are consistently met is where the rubber meets the road, which makes factors such as quality, form factor, and smart solutions that leverage technology for seamless integration crucial.

A Strategy Anchored on Three Pillars

Shure’s growth blueprint rests on localization, partnerships, and education.

Localization ensures that global standards are adapted to regional requirements. A broadcaster in Abu Dhabi may demand wireless mobility, while a university in Riyadh seeks scalable, user-friendly systems. Meeting these nuanced needs requires agility and customization.
Partnerships with distributors, integrators, and resellers expand reach and sustain service excellence. These trusted relationships are critical to delivering value on the ground.
Education equips professionals with the right skills to maximize technology investments. Through training initiatives, Shure empowers AV specialists to deploy and maintain systems effectively, ensuring customers achieve long-term returns.

Technology and Innovation at the Forefront

We strongly believe that the future of audio in the region will be shaped by three defining trends.

Immersive experiences are becoming a cultural norm, and audio must now create impact as much as it delivers clarity.
AI and intelligent systems are moving from concept to reality making adaptive audio that responds to its environment the way to go.
Hybrid environments will remain central to work and education even as physical and virtual interactions merge with audio determining whether collaboration succeeds or fails.

A century of sound, a future of possibility

This year, Shure marks its 100-year anniversary. Few technology brands reach such a milestone, and fewer still do so with their reputation for quality and trust intact. For customers and partners in MEA and beyond, the centennial is not merely a celebration of heritage. It is a reassurance that Shure’s next century will be guided by the same principles that made it a global leader – with innovation, reliability, and customer focus at the core.

As the region accelerates its digital and cultural transformation, professional audio will only grow in importance. For IT leaders, this means viewing sound not as an afterthought, but as a strategic layer of infrastructure – one that underscores effective communication, collaboration, and connection.

Shure’s growth story is far from complete. The company’s next chapter is being written in partnership with the region’s institutions and enterprises. And in an age where voices need to be heard clearly across physical and digital spaces, Shure’s mission remains simple: to deliver sound that empowers progress.