Connect with us

Tech Features

In the Crosshairs of APT Groups: A Feline Eight-Step Kill Chain

Published

on

hacking

By Alexander Badaev, Information security threat researcher, Positive Technologies Expert Security Center and Yana Avezova, Senior Research Analyst, Positive Technologies

In cybersecurity, “vulnerability” typically evokes concern. One actively searches for it and patches it up to build robust defenses against potential attacks. Picture a carefully orchestrated robbery, where a group of skilled criminals thoroughly examines a building’s structure, spots vulnerabilities, and crafts a step-by-step plan to breach security and steal valuables. This analogy perfectly describes the modus operandi of cybercriminals, with the “kill chain” acting as their detailed blueprint.

In a recent study, analysts from Positive Technologies gathered information on 16 hacker groups attacking the Middle East analyzing their techniques and tactics. It is worth noting that most of the threats in Middle Eastern countries come from groups believed to be linked to Iran—groups such as APT35/Charming Kitten or APT34/Helix Kitten. Let’s see how APT groups operate, how they initiate attacks, and how they develop them toward their intended targets.

Step 1: The Genesis of Intrusion (Attack preparation)

It all begins with meticulous planning and reconnaissance. APT groups leave no stone unturned in their quest for vulnerable targets. They compile lists of public systems with known vulnerabilities and gather employee information. For instance, groups like APT35 aka Charming Kitten known for targeting mainly Saudi Arabia and Israel, gather information about employees of target organizations, including mobile phone numbers, which they leverage for nefarious purposes like sending malicious links disguised as legitimate messages. After reconnaissance, they prepare tools for attacks, such as registering fake domains and creating email or social media accounts for spear phishing. For example, APT35 registers accounts on LinkedIn and other social networks to contact victims, persuading them through messages and voice calls to open malicious links.

Step 2: The Initial Access: Gaining a Foothold

Once armed with intelligence, cybercriminals proceed to gain initial access to their target’s network.  Phishing campaigns, often masquerading as legitimate emails, serve as the primary means of infiltration. An example is the Desert Falcons group, observed spreading their malware through pornographic phishing. Notably, some groups go beyond traditional email phishing, utilizing social networks and messaging platforms to lure unsuspecting victims, as seen with APT35, Bahamut, Dark Caracal, and OilRig. Moreover, techniques like the watering hole method, where attackers compromise trusted websites frequented by their targets, further highlight the sophistication of these operations. Additionally, attackers exploit vulnerabilities in resources accessible on the internet to gain access to internal infrastructure. For example, APT35 and Moses Staff exploited ProxyShell vulnerabilities on Microsoft Exchange servers.

Step 3: Establishing Persistence: The Art of Concealment

Having breached the perimeter, APT groups strive to establish a foothold within the victim’s infrastructure, ensuring prolonged access and control. This involves deploying techniques such as task scheduling, as seen in the campaign against the UAE government by the OilRig group, which created a scheduled task triggering malicious software every five minutes. Additionally, many malicious actors set up malware autostart, like the Bahamut group creating LNK files in the startup folder or Dark Caracal’s Bandook trojan. Some APT groups, such as APT33, Mustang Panda, and Stealth Falcon, establish themselves in victim infrastructures by creating subscriptions to WMI events for event-triggered execution. Furthermore, attackers exploit vulnerabilities in server applications to install malicious components like web shells, which provide a backdoor for remote access and data exfiltration.

Step 4: Unraveling the Network: Internal Reconnaissance

After breaking in, APT groups don’t just sit there. They explore the system like a thief casing a house to find valuables and escape routes. This digital reconnaissance involves several steps. First, they perform an inventory check, identifying the computer’s operating system, installed programs, and updates, like figuring out a house’s security measures. For instance, APT35 might use a simple command to see if the computer is a powerful 64-bit system, capable of handling more complex tasks. Second, they map the network layout, akin to identifying valuable items and escape routes. APT groups might use basic tools like “ipconfig” and “arp” (like Mustang Panda) to see how devices are connected and communicate. They also search for user accounts and activity levels, understanding who lives in the house (figuratively) and their routines. Malicious tools, like the Caterpillar web shell used by Volatile Cedar, can list all usernames on the system. Examining running programs is another tactic, like checking for security guards. Built-in commands like “tasklist” (used by APT15 and OilRig) can reveal a list of programs currently running.

Finally, APT groups might deploy programs that hunt for secrets hidden within files and folders, like searching for hidden safes or documents. The MuddyWater group, for example, used malware that specifically checked for directories or files containing keywords related to antivirus software. By gathering this comprehensive intel, APT groups can craft targeted attacks, steal sensitive data like financial records or personal information, or exploit vulnerabilities in the system to cause even more damage.
Step 5: Harvesting Credentials: Unlocking the Vault

Access to privileged credentials is the holy grail for cyber attackers, granting them unrestricted access to critical systems and data. One common tactic is “credential dumping,” where tools like Mimikatz (used by APT15, APT33, and others) snatch passwords directly from a system’s memory, similar to stealing a key left under a doormat. Keyloggers, used by APT35 and Bahamut for example, acts like a hidden camera, silently recording keystrokes to capture usernames and passwords as victims type them in.

These stolen credentials grant access to even more sensitive areas. APT groups also exploit weaknesses in how passwords are stored. For instance, some target the Windows Credential Manager (like stealing a notepad with written down passwords). Brute-force attacks, trying millions of combinations, can crack weak passwords. Even encrypted passwords can be vulnerable if attackers have specialized tools. By employing these tactics, APT groups bypass initial security and access sensitive information or critical systems.

Step 6: Data Extraction: The Quest for Valuable Assets

Once inside, APT groups aren’t shy about snooping around. They leverage stolen credentials to capture screenshots, record audio and video (like hidden cameras and microphones), or directly steal sensitive files and databases. For instance, the Dark Caracal group employed Bandook malware, which can capture video from webcams and audio from microphones. This stolen data becomes their loot.

To ensure a smooth getaway, APT groups often employ encryption and archiving techniques. Imagine them hiding their stolen treasure chests—the Mustang Panda group, for example, encrypted files with RC4 and compressed them with password protection before shipping them out. This makes it difficult for defenders to identify suspicious activity amongst regular network traffic.

Step 7: Communication Channels: Establishing Control

APT groups rely on hidden communication channels with command-and-control (C2) servers to control infected machines and exfiltrate data. They employ various tactics to blend in with regular network traffic. This includes using common protocols (like IRC or DNS requests disguised as legitimate web traffic) and encrypting communication for further stealth.

However, some groups take it a step further. For instance, OilRig used compromised email servers to send control messages hidden within emails and then deleted them, making their C2 channel nearly invisible. These innovative techniques make it difficult for security measures to detect malicious activity, highlighting the importance of staying informed about evolving APT tactics.

Step 8: Covering Tracks: Erasing Digital Footprints

As the operation ends, APT groups meticulously cover their tracks to evade detection and prolong their presence in the compromised environment. Techniques like file obfuscation, masquerading, and indicator removal are employed to erase digital footprints and thwart forensic investigations. For example, the Bahamut group used icons mimicking Microsoft Office files to disguise malware, and the OilRig group used .doc file extensions to make malware appear as office documents. The Moses Staff group named their StrifeWater malware calc.exe to make it look like a legitimate calculator program.

To further bypass defenses, attackers often proxy the execution of malicious commands using files signed with trusted digital certificates. The APT35 group used the rundll32.exe file to execute the MiniDump function from the comsvcs.dll system library when dumping the LSASS process memory. Meanwhile, the Dark Caracal group employed a Microsoft Compiled HTML Help file to download and execute malicious files. Many APT groups also remove signs of their activity by clearing event logs and network connection histories, and changing timestamps. For instance, APT35 deleted mailbox export requests from compromised Microsoft Exchange servers. This meticulous cleaning makes it much more difficult for cybersecurity professionals to conduct post-incident investigations, as attackers often remove their arsenal of software from compromised devices after achieving their goals.

Conclusion: A Call to Vigilance

In a nutshell, the threat landscape in the Middle East is fraught with peril, as APT groups continue to refine their tactics and techniques to evade detection and wreak havoc on unsuspecting organizations. By understanding the anatomy of cyber intrusions and remaining vigilant against emerging threats, organizations can bolster their defenses and mitigate the risks posed by these sophisticated adversaries. Together, let us remain steadfast in our commitment to safeguarding the digital frontier against cyber threats.

Research Link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech Features

How sustainable materials and AI are shaping NEOM, Masdar City, and Dubai’s new developments

Published

on

The Dubai Beach EDITION Hotel and Residences at Dubai Harbour by Shamal Holdings



NEOM, Masdar City and Dubai, cities that have long been a symbol of wealth and ambition, are not just building new skylines, they’re attempting to redefine what a city can be. With construction sector being one of the largest contributors to global emission, Middle East, flush with capital, ambitious projects, and new masterplans is testing a simple hypothesis: Can the region radically lower the carbon and resource footprint of entire cities through sustainable materials and Artificial Intelligence (AI)?

Dr. Vahid Razaviarani, Global Programme Director,
MSc Global Sustainability Engineering
Heriot-Watt University

Governments and developers, in the Gulf, are shifting policies and procurement practices toward low-embodied-carbon alternatives: recycled aggregates, low-carbon concrete, engineered timber, high-performance insulation and off-site modular systems that dramatically cut waste. According to Grand View Research, in 2024, the global green building materials market was estimated to be worth hundreds of billions of dollars, and it is forecast to grow. Moreover, the GCC green building materials market alone reached an estimated USD 10.6 billion in 2024 and, according to an IMARC Group report, is expected to grow significantly as demand for sustainable inputs scales up.

NEOM’s energy and utilities arm, Enowa, explicitly emphasises circular systems and positions the project as a 100%renewables-powered ecosystem that integrates water, energy and industrial systems from the outset. It combines Industry 4.0 technologies with circular economy principles that force the choice of materials toward those that can be reused or easily recycled, while promoting off-site fabrication techniques that shrink construction waste.

For more than a decade, Masdar City has been offering a working prototype of what happens when sustainable material choices meet a systems approach, translating low-carbon urban design into practice. It pairs demonstrable clean energy capacity with district cooling systems, solar generation, and energy-efficient building envelopes with planning that reduces transport demand. Masdar’s broader organisation, its parent group, has also been scaling fast. Its report highlighted growth in clean energy capacity and an organisational push into integrated, low-carbon urban projects. The Masdar model is a reminder that reliable renewable supply makes higher-embodied, energy-intensive solutions (for example, electric construction equipment charged by renewables).

But materials alone won’t be enough, this is where AI becomes a multiplier. AI tools now enable topology optimisation for material efficiency, predict and prevent waste by logistics algorithms (supply chain forecasting, demand matching). In operations, machine learning drives HVAC optimisation (manage buildings in real time, predictive maintenance). For projects on the scale of NEOM or Masdar, with thousands of buildings, millions of square meters and complex infrastructure, AI systems can turn millions of data points into continuous efficiency gains.  NEOM and related initiatives are already integrating AI for water, energy and materials planning, while Oxagon’s industrial model assumes broad adoption of automation and AI in production.

Dubai’s trajectory shows how regulation and market amplify these technological shifts and incentives accelerate adoption. Municipal green building regulations, alongside certifications such as LEED and local green building systems, have driven a rapid uptake of sustainable construction practices, pushing developers to pursue energy-efficient envelopes, reduced water use, and green materials. According to Dubai Municipality, the city’s policy environment, paired with developers’ appetite for premium assets that offer lower operating costs and resilience to climate risk, creates an ecosystem where sustainable materials and smart building systems are not only environmentally desirable but financially sensible.

The Grand View Research estimates show the Gulf’s green-building sector and related materials markets expanding rapidly, with market valued in the mid-to-high tens of billions of dollars and forecast to double-digit compound annual growth rates in the coming five years. That inflow of capital matters because sustainable materials often carry higher up-front cost but deliver lower lifecycle costs, while AI and automation substantially reduce construction and lifecycle operating overruns. In other words, together they improve the return profile for long-term investors.

Yet ambition collides with practical constraints. Supply chains for low-embodied materials must scale quickly; while those in the region remain sensitive to cost, logistics, and local standards. Skilled labour in advanced assembly and data-science expertise to drive AI systems are limited and must be cultivated. Governance questions are also pressing: who owns the data generated by smart urban systems, how is privacy protected, and how do we ensure that AI allocates resources such as water, energy and mobility fairly. These are governance design problems, solvable, if tackled deliberately.

There are three pragmatic approaches for solving them. First, governments and project sponsors can accelerate local manufacturing of green materials through incentives and public-private partnerships. Second, procurement rules should favour lifecycle carbon and circularity over the lowest upfront price; that shifts incentives toward durable, reusable materials and off-site fabrication. Third, data-governance frameworks must be established from the outset: transparent rules about ownership and enable third-party innovation without commercial capture.

If NEOM, Masdar City and Dubai’s new districts can scale these approaches, the payoff will be tangible: lower lifecycle emissions, less construction waste, healthier indoor environments, and long-term savings for investors and taxpayers. The Middle East can move beyond being a market for imported technology to becoming a global crucible for sustainable urban practices, provided policymakers, developers and technologists align incentives and share data and best practices.

NEOM, Masdar and Dubai’s new districts are more than national statements; they are testbeds whose lessons could reshape how cities are built globally. If they get it right, prioritising lifecycle outcomes, scaling green materials, and embedding AI from design to operations, Middle East will be measured not only in square metres and skylines, but in the tonnes of embodied carbon avoided and the megabytes of intelligence that keep cities efficient and humane. The world will, for once, be watching not only to admire, but to learn.

Continue Reading

Tech Features

Smart Grids: Powering the Middle East’s Renewable Energy Future

Published

on

Smart Grids: Powering the Middle East’s Renewable Energy Future

Dr. Mutasim Nour, Director of MSc Energy, School of Engineering and Physical Sciences, Heriot- Watt University Dubai 

The usage of green energy has soared in the Middle East in recent years, highlighting the region’s futuristic and sustainable approach to socio-economic growth. According to a report by Rystad Energy, by 2050 renewable energy sources, including hydro, solar, and wind are expected to constitute a staggering 70 percent of the region’s power generation mix – a massive jump from the five percent recorded at the end of 2023.  The UAE stands out in particular, ranking 10th globally in per capita solar capacity in 2023, with an impressive 708 watts per capita as per the World Future Energy Summit 2025 report. From a modest 12 MW in 2012 to an ambitious 6.1 GW in 2023, the UAE’s solar capacity has grown rapidly.  Saudi Arabia is also making significant progress in this domain, with over 17 major renewable projects producing 41.2 million MWh annually that are aimed at fulfilling nearly 66 percent of residential energy needs.

These diversification efforts are accelerators of economic development as well as environmental well-being. However, green energy relies on variables that often fluctuate such as temperature, season, and wind intensity. This makes balancing supply and demand a complicated task requiring innovative solutions. The most promising one has been found in Smart Grids, which are an upgraded version of the traditional power network. These grids use digital technologies to monitor, predict, and respond to energy demand in real time, and enable two-way interactions where consumers can also produce energy (through solar panels, for example) and feed it back into the system. Their components include an Advanced Metering Infrastructure (AMI), grid automation and control, energy storage, and demand response programs that help them deliver superior results.

Smart grids are more flexible, efficient, and reliable compared to traditional grids and have helped significantly strengthen the renewable energy infrastructure in the Middle East. Saudi Arabia, for instance, has been developing AI-powered smart grids to integrate renewable energy and modernise infrastructure as part of its Vision 2030 initiative.  It has already automated 32% of its electricity distribution network and installed more than 11 million smart meters to further meet its goal of achieving net-zero emissions by 2060.

The UAE has also emerged as a pioneer in renewable energy innovation. Under the UAE Energy Strategy 2050, the nation aims to triple its renewable energy contributions by 2030 and achieve a 50 percent clean energy mix by 2050, aided by a substantial investment of AED150-200 billion.   The Department of Energy in Abu Dhabi also recently announced the first legally binding clean and renewable energy target in the Middle East called the Clean Energy Strategic Target 2035. This regulatory framework dictates that 60 per cent of the emirate’s electricity will be generated from clean and renewable sources by 2035, and there will be up to 75 per cent reduction in carbon emissions per MWh produced by the electricity sector. Energy storage solutions to achieve this goal, due to which the Department of Energy has signed a Memorandum of Understanding with the State Grid Corporation of China to build a strong and highly efficient smart energy and power system.

 In Dubai, progress in green energy is being led by the Dubai Electricity and Water Authority (DEWA), which has executed a $1.9 billion smart-grid initiative to deliver high standards of reliability and energy management. The smart grid initiative has helped DEWA achieve some remarkable outcomes: in 2023, line losses in electricity transmission and distribution networks were reduced to 2 percent, compared to 6-7 percent in Europe and the US. Additionally, water network losses dropped to 4.6 percent, significantly lower than approximately 15 percent reported in North America.

Even as smart grids transform the energy landscape, there are challenges that hinder the ability to effectively scale them up. These include:

  • Technical interoperability: Smart Grids run on a complex mix of sensors, meters, and communication devices that are often made by different manufacturers. Ensuring that all data between these components is compatible and integrated correctly is often a difficult feat.    
  • Cybersecurity: The reliance on digital communications and internet-based technologies in Smart Grids bring a new set of challenges with them. There is increased vulnerability to cyber-attacks that can lead to power outages, data breaches, and even structural damage to grid infrastructure.
  • Regulatory barriers: Current regulations and policies often need to be adapted for the dynamism of smart grids. A clear and streamlined framework makes adoption easier and attracts investments into this technology.
  •  Consumer awareness: Consumers can be skeptical of the advantages a smart grid presents, especially due to data privacy concerns and doubts regarding wireless communication. Initiatives like community education and incentivisation can go a long way in increasing consumer acceptance and support.

Smart grids also depend on a high initial investment and regular infrastructure upgrades to function properly. To address these challenges, governments across the world must formulate a comprehensive strategy that outlines the investment, infrastructure, and education required for smart grid networks in their region. A streamlined approach and clear objectives can revolutionise green energy integration and help mitigate climate change. With smart grids, consumers are empowered to become a part of the energy ecosystem and foster a culture of conservation and sustainability.

Continue Reading

Tech Features

HR-led Initiatives to nurture women-led TECH startups

Published

on

A portrait of Professor Fiona Robson, Head of the School of Social Sciences and Edinburgh Business School, Heriot-Watt University Dubai

Professor Fiona Robson,

Head of the School of Social Sciences & Edinburgh Business School

HR is no longer just about recruitment and retention – there is a growing trend towards taking a more creative and innovative approach. This can involve looking at talent through different lenses rather than seeing it as a hierarchical talent management process focusing on vertical promotions within the organization.

In an age where HR rightly have a seat at the strategic table for decision making, they have the opportunity to ensure that appropriate levels of funding and expertise are used to develop a forward-looking talent strategy that goes beyond the norm. Artificial intelligence (AI) brings a plethora of opportunities for organisations to be braver in how they identify potential talent. Using AI to identify talent can be a useful starting point but when it comes to areas such as innovation and identifying an entrepreneurial mindset, it may be more difficult to pinpoint the traits which could indicate potential to innovate.

Where HR teams start to consider and plot non-traditional pathways they may be able to recruit and retain employees with diverse skillsets. Taking an entrepreneurial path opens up the talent pool as it isn’t as focused on people looking at the next hierarchical step up within the organisation. This is important as there are usually resource constraints about how many vacancies are available to fill at the highest pay grades in the organisation. These new pathways should provide opportunities for women to shine in different types of projects and recognise the strategic importance of creative thinking and innovation.

Providing testing opportunities

Depending on the level of finance available there are some additional resources that could be provided. Innovation sprints or challenges can be a great way to test out ideas and receive feedback from different groups of stakeholders. They may facilitate prototyping and identify issues that were not previously considered. Internal technology venture labs can also provide a safe environment to test out ideas and proof of concept. Collaborating with Universities who are experienced in running labs and sprints can be very beneficial, they may also have access to funding to support the development of new products and services. However, in order to be truly successful, they need to ensure that there is a sustainable follow up process before the momentum deflates.

Inclusive Procurement and Equitable IP Policies

Organisations can seek to lead the way and exhibit good practice by reviewing their procurement policies where practicable to ensure that they are inclusive. Examples may include having provision for flexible payment terms which would make it easier for those at the beginning of their entrepreneurship journey. Access to specialist support which could help women to set up their businesses in a more timely way could also break down some of the perceived barriers. Often the processes around procurement can be rather cumbersome so the provision of training which shows exactly how to navigate it could be helpful. Forward looking organisations might seek to approve a process whereby women entrepreneurs are given priority with their applications.

For many women, even thinking about intellectual property (IP) and patents can seem overwhelming if they have never had exposure to this world before. The introduction of simplified processes could act as a springboard to attract more women, particularly if the timeline can be expedited so that there is a shorter gap between the initial idea and when it is approved. Having access to real case studies showing how this happens would also be reassuring. In large organisations, the HR team may be able to encourage the legal team to provide some initial advice so that prospective entrepreneurs get a realistic insight into whether their proposal has merit or not.

Commercial Advantage Through Policy

HR can make a name for itself by encouraging innovation through widening participation and breaking down barriers to encourage, support and recognise innovation. For some HR professionals this may be quite a shift for them so they may also require some reskilling and retraining.

It would be good practice for organisations to regularly review their HR policies to ensure that they reflect the changing eco-system and that there are appropriate diversity clauses within the library of policies, procedures and practices. As part of this, ensuring that there is awareness of bias and how this can sneak into processes unconsciously and inadvertently disadvantage women. The establishment of women’s networks would be a proactive approach and could help them at all of the different stages of developing and executing their entrepreneurial ideas.

Providing funding opportunities may be one of the most impactful decisions that an organisation can make. Obviously this would need to have transparent parameters around it but it could be the difference between an idea being turned into practice or not. If the funding allocation is governed by stakeholders with appropriate expertise in different areas i.e. finance, law, governance and people, this would reduce the organisational risk of investing in small new businesses. Where there isn’t a potential conflict of interest, organisations could also make a significant impact by facilitating market entry and opening doors within networks and supply chains.

Continue Reading

Trending

Copyright © 2023 | The Integrator