Tech Features

In the Crosshairs of APT Groups: A Feline Eight-Step Kill Chain

Published

2 years ago

June 27, 2024

By Alexander Badaev, Information security threat researcher, Positive Technologies Expert Security Center and Yana Avezova, Senior Research Analyst, Positive Technologies

In cybersecurity, “vulnerability” typically evokes concern. One actively searches for it and patches it up to build robust defenses against potential attacks. Picture a carefully orchestrated robbery, where a group of skilled criminals thoroughly examines a building’s structure, spots vulnerabilities, and crafts a step-by-step plan to breach security and steal valuables. This analogy perfectly describes the modus operandi of cybercriminals, with the “kill chain” acting as their detailed blueprint.

In a recent study, analysts from Positive Technologies gathered information on 16 hacker groups attacking the Middle East analyzing their techniques and tactics. It is worth noting that most of the threats in Middle Eastern countries come from groups believed to be linked to Iran—groups such as APT35/Charming Kitten or APT34/Helix Kitten. Let’s see how APT groups operate, how they initiate attacks, and how they develop them toward their intended targets.

Step 1: The Genesis of Intrusion (Attack preparation)

It all begins with meticulous planning and reconnaissance. APT groups leave no stone unturned in their quest for vulnerable targets. They compile lists of public systems with known vulnerabilities and gather employee information. For instance, groups like APT35 aka Charming Kitten known for targeting mainly Saudi Arabia and Israel, gather information about employees of target organizations, including mobile phone numbers, which they leverage for nefarious purposes like sending malicious links disguised as legitimate messages. After reconnaissance, they prepare tools for attacks, such as registering fake domains and creating email or social media accounts for spear phishing. For example, APT35 registers accounts on LinkedIn and other social networks to contact victims, persuading them through messages and voice calls to open malicious links.

Step 2: The Initial Access: Gaining a Foothold

Once armed with intelligence, cybercriminals proceed to gain initial access to their target’s network. Phishing campaigns, often masquerading as legitimate emails, serve as the primary means of infiltration. An example is the Desert Falcons group, observed spreading their malware through pornographic phishing. Notably, some groups go beyond traditional email phishing, utilizing social networks and messaging platforms to lure unsuspecting victims, as seen with APT35, Bahamut, Dark Caracal, and OilRig. Moreover, techniques like the watering hole method, where attackers compromise trusted websites frequented by their targets, further highlight the sophistication of these operations. Additionally, attackers exploit vulnerabilities in resources accessible on the internet to gain access to internal infrastructure. For example, APT35 and Moses Staff exploited ProxyShell vulnerabilities on Microsoft Exchange servers.

Step 3: Establishing Persistence: The Art of Concealment

Having breached the perimeter, APT groups strive to establish a foothold within the victim’s infrastructure, ensuring prolonged access and control. This involves deploying techniques such as task scheduling, as seen in the campaign against the UAE government by the OilRig group, which created a scheduled task triggering malicious software every five minutes. Additionally, many malicious actors set up malware autostart, like the Bahamut group creating LNK files in the startup folder or Dark Caracal’s Bandook trojan. Some APT groups, such as APT33, Mustang Panda, and Stealth Falcon, establish themselves in victim infrastructures by creating subscriptions to WMI events for event-triggered execution. Furthermore, attackers exploit vulnerabilities in server applications to install malicious components like web shells, which provide a backdoor for remote access and data exfiltration.

Step 4: Unraveling the Network: Internal Reconnaissance

After breaking in, APT groups don’t just sit there. They explore the system like a thief casing a house to find valuables and escape routes. This digital reconnaissance involves several steps. First, they perform an inventory check, identifying the computer’s operating system, installed programs, and updates, like figuring out a house’s security measures. For instance, APT35 might use a simple command to see if the computer is a powerful 64-bit system, capable of handling more complex tasks. Second, they map the network layout, akin to identifying valuable items and escape routes. APT groups might use basic tools like “ipconfig” and “arp” (like Mustang Panda) to see how devices are connected and communicate. They also search for user accounts and activity levels, understanding who lives in the house (figuratively) and their routines. Malicious tools, like the Caterpillar web shell used by Volatile Cedar, can list all usernames on the system. Examining running programs is another tactic, like checking for security guards. Built-in commands like “tasklist” (used by APT15 and OilRig) can reveal a list of programs currently running.

Finally, APT groups might deploy programs that hunt for secrets hidden within files and folders, like searching for hidden safes or documents. The MuddyWater group, for example, used malware that specifically checked for directories or files containing keywords related to antivirus software. By gathering this comprehensive intel, APT groups can craft targeted attacks, steal sensitive data like financial records or personal information, or exploit vulnerabilities in the system to cause even more damage.
Step 5: Harvesting Credentials: Unlocking the Vault

Access to privileged credentials is the holy grail for cyber attackers, granting them unrestricted access to critical systems and data. One common tactic is “credential dumping,” where tools like Mimikatz (used by APT15, APT33, and others) snatch passwords directly from a system’s memory, similar to stealing a key left under a doormat. Keyloggers, used by APT35 and Bahamut for example, acts like a hidden camera, silently recording keystrokes to capture usernames and passwords as victims type them in.

These stolen credentials grant access to even more sensitive areas. APT groups also exploit weaknesses in how passwords are stored. For instance, some target the Windows Credential Manager (like stealing a notepad with written down passwords). Brute-force attacks, trying millions of combinations, can crack weak passwords. Even encrypted passwords can be vulnerable if attackers have specialized tools. By employing these tactics, APT groups bypass initial security and access sensitive information or critical systems.

Step 6: Data Extraction: The Quest for Valuable Assets

Once inside, APT groups aren’t shy about snooping around. They leverage stolen credentials to capture screenshots, record audio and video (like hidden cameras and microphones), or directly steal sensitive files and databases. For instance, the Dark Caracal group employed Bandook malware, which can capture video from webcams and audio from microphones. This stolen data becomes their loot.

To ensure a smooth getaway, APT groups often employ encryption and archiving techniques. Imagine them hiding their stolen treasure chests—the Mustang Panda group, for example, encrypted files with RC4 and compressed them with password protection before shipping them out. This makes it difficult for defenders to identify suspicious activity amongst regular network traffic.

Step 7: Communication Channels: Establishing Control

APT groups rely on hidden communication channels with command-and-control (C2) servers to control infected machines and exfiltrate data. They employ various tactics to blend in with regular network traffic. This includes using common protocols (like IRC or DNS requests disguised as legitimate web traffic) and encrypting communication for further stealth.

However, some groups take it a step further. For instance, OilRig used compromised email servers to send control messages hidden within emails and then deleted them, making their C2 channel nearly invisible. These innovative techniques make it difficult for security measures to detect malicious activity, highlighting the importance of staying informed about evolving APT tactics.

Step 8: Covering Tracks: Erasing Digital Footprints

As the operation ends, APT groups meticulously cover their tracks to evade detection and prolong their presence in the compromised environment. Techniques like file obfuscation, masquerading, and indicator removal are employed to erase digital footprints and thwart forensic investigations. For example, the Bahamut group used icons mimicking Microsoft Office files to disguise malware, and the OilRig group used .doc file extensions to make malware appear as office documents. The Moses Staff group named their StrifeWater malware calc.exe to make it look like a legitimate calculator program.

To further bypass defenses, attackers often proxy the execution of malicious commands using files signed with trusted digital certificates. The APT35 group used the rundll32.exe file to execute the MiniDump function from the comsvcs.dll system library when dumping the LSASS process memory. Meanwhile, the Dark Caracal group employed a Microsoft Compiled HTML Help file to download and execute malicious files. Many APT groups also remove signs of their activity by clearing event logs and network connection histories, and changing timestamps. For instance, APT35 deleted mailbox export requests from compromised Microsoft Exchange servers. This meticulous cleaning makes it much more difficult for cybersecurity professionals to conduct post-incident investigations, as attackers often remove their arsenal of software from compromised devices after achieving their goals.

Conclusion: A Call to Vigilance

In a nutshell, the threat landscape in the Middle East is fraught with peril, as APT groups continue to refine their tactics and techniques to evade detection and wreak havoc on unsuspecting organizations. By understanding the anatomy of cyber intrusions and remaining vigilant against emerging threats, organizations can bolster their defenses and mitigate the risks posed by these sophisticated adversaries. Together, let us remain steadfast in our commitment to safeguarding the digital frontier against cyber threats.

Research Link

Tech Features

Why UAE organisations cannot afford to get their AI storage strategy wrong

Published

1 day ago

August 20, 2026

Integrator Web-Editor

BY: Owais Mohammed, Regional Lead & Sales Director at WD for the Middle East, Africa, Turkey, and the Indian Subcontinent

The UAE’s ambition to become a global AI powerhouse is well established. Government investment is flowing, infrastructure is scaling, and organisations across every sector are accelerating their AI programs. But beneath the strategic announcements and the technology deployments, a fundamental question goes unanswered: is the data storage infrastructure underpinning all this built for what comes next?

For many organisations, the honest answer is: not yet. Storage is rarely the first conversation in an AI strategy discussion. It tends to be treated as a commodity decision made late in the planning cycle, long after the headline architecture choices like GPUs/CPUs have been made. That approach made sense in simpler times, but not in today’s data-driven AI economy.

The scale of what is coming

To understand why, organisations need to understand the sheer data volume that is coming their way. Global data creation is forecast to rise to 718.5 Zettabytes (ZB) through 2030 (IDC source: Market Forecast: IDC Global DataSphere Forecast, 2026-2030, June 2026, Doc #US53425426), more than tripling in five years.

AI is both a driver and a consumer of this growth. Every model trained, every inference run, every data pipeline operating continuously across a distributed architecture is generating and demanding access to data at a scale that earlier generations of infrastructure were not designed to support.

Businesses that will absorb this growth successfully are not those with the fastest individual components. They are those with architectures designed to handle volume, variety, and velocity simultaneously, at a cost that remains economically sustainable as scale increases. That is the storage strategy challenge that needs to be addressed upfront and not as an afterthought.

Why a single technology cannot solve it

A common mistake is to frame the storage decision as a technology choice: SSDs versus HDDs, flash versus spinning disk, performance versus capacity. The world’s most sophisticated storage operators, including hyperscalers and major cloud service providers, have already moved past this framing. They do not choose one technology. They deploy multiple of them, in a tiered architecture that places data on the medium best suited to its requirements.

The logic is straightforward. SSDs deliver the high IOPS and low latency that real-time, performance-critical applications demand. HDDs provide the massive capacity and cost efficiency required for the vast middle tier of active and warm data, and currently continue to represent approximately 63% of worldwide installed storage capacity through 2030. Tape generally handles archival, regulatory, and compliance workloads where retrieval times of hours or days are acceptable, representing just under 8% of worldwide installed cloud storage capacity in 2025.

These are not competing technologies. They are complementary ones, each serving a distinct purpose within a coherent architecture. The question is how each is deployed where it delivers the greatest value.

Making tiered architectures work in practice

Knowing that tiered storage is the right model and implementing it effectively are two different things. At the scale hyperscalers operate, where storage volumes are measured in hundreds of exabytes, manual allocation of data across tiers is neither practical nor efficient. Nor can all data live on cost prohibitive flash. The mechanism that makes tiered architecture manageable is software-defined storage (SDS), which pools resources centrally and provisions capacity dynamically based on demand. Rather than pre-allocating fixed capacity to individual applications, SDS responds to where data needs to be, improving overall utilisation and reducing waste.

Together, tiered architecture and SDS provide the flexibility and economic efficiency that hyperscale environments depend on. But this model is not the exclusive preserve of the world’s largest operators. For emerging infrastructure providers, including Neoclouds that are expanding rapidly across the region, the same principles apply. Architecture decisions made today will determine whether future growth is economically sustainable or structurally constrained. The window to get this right is earlier than many organisations assume.

Innovation at the storage level

Architectural thinking also changes how storage technology itself must evolve. An organisation that understands its workloads, plans for data growth, and builds tiered infrastructure will eventually reach the limits of what current storage innovations can deliver. That is why, manufacturers like WD are approaching HDDs not only as a mature, reliable product but as a technology with significant headroom remaining to help increase capacity, lower power and cost effectively scale AI data. They are advancing recording technologies, exploring novel materials, and embedding intelligence at the drive level. The aim is not incremental improvement. It is expanding the boundary of what high-capacity storage can deliver for the architectures customers are building today and the workloads they will run tomorrow.

The leadership dimension

The organisations that navigate the AI era most effectively will not be those that simply procure the latest hardware. It will be those that understand the architectural decisions that determine long-term performance, cost and scale, ask better questions earlier in the planning process, and treat storage infrastructure strategy as a source of competitive advantage rather than a procurement exercise.

Storage sits at the foundation of every AI workload, every data pipeline, and every digital service an organisation delivers. Getting the architecture right is not a technical detail. It is a leadership decision. And in a market moving as quickly as the UAE’s, it is one that deserves to be made with the same rigour and strategic intent as any other.

Tech Features

Beyond a Seat at the Table: How Emirati Women Are Leading the UAE’s Next Chapter

Published

2 days ago

August 19, 2026

Integrator Web-Editor

Every year, Emirati Women’s Day offers a moment to pause and reflect on just how far Emirati women have come, and how much further their ambitions are taking them. Across artificial intelligence and technology, entrepreneurship, sustainability, industry and beyond, Emirati women are no longer simply entering these spaces, they are shaping them, leading critical decisions and setting new benchmarks for what is possible.

This progress has not happened by chance. It is the result of a national vision that has consistently placed women’s empowerment at the heart of the UAE’s development, widely regarded as the driving force behind the advancement of Emirati women. Together, these efforts have built an ecosystem of mentorship, opportunity and structural support that allows Emirati women to move beyond simply having a seat at the table to actively influencing the direction of entire industries.

This Emirati Women’s Day, we spoke to three Emirati women who are doing exactly that, each carving out space in fields as varied as AI infrastructure, entrepreneurship and industrial sustainability. Their stories reflect not only how far the journey has come, but also a shared sense of responsibility: to keep the doors open, and to inspire the next generation of Emirati women to walk through them with confidence.

Amal Almaamari, Program Director at Core42, (a G42 Company)

The UAE has created an environment where women are encouraged to pursue ambitious careers, take on meaningful responsibilities and contribute to sectors that are shaping the country’s future. As an Emirati woman working in AI, I see this opportunity firsthand. At Core42, I am able to contribute to the infrastructure and capabilities helping organizations adopt AI securely, at scale and with greater control over their data and technology.

What is particularly inspiring is seeing Emirati women increasingly take on roles across engineering, product development, strategy and leadership. The opportunities available today allow us not only to participate in the technology sector, but to build expertise, influence decisions and contribute to the UAE’s ambitions in AI and advanced technology.

Emirati Women’s Day is a celebration of that progress and the confidence the UAE continues to place in its women. It also reminds us of our responsibility to build on these opportunities and inspire the next generation of Emirati women to see technology as a field where they can grow, lead and make a lasting impact.

Amreen Iqbal, Founder and Creative Director of Piece of You

What stands out to me about building a business here is how much the UAE actively invests in women being part of its growth story. From mentorship networks to platforms that put Emirati entrepreneurs in front of the right audiences, the opportunities aren’t hypothetical, they’re structural. Piece of You exists because I had the confidence and support to take an idea and turn it into something real. On Emirati Women’s Day, I think about how many doors have opened for women in my generation that weren’t open before, and how many more are opening for the next one.

Hamda Al Shamsi, Admin Assistant at Geocycle Waste Recycling UAE at Holcim UAE

The UAE has created an environment where women are empowered to pursue their ambitions, develop their skills, and contribute meaningfully across every sector. Today, Emirati women are building careers in fields ranging from technology and engineering to sustainability, manufacturing, energy, and leadership.

As an Emirati woman and the only woman currently working at Geocycle UAE, I have personally experienced the importance of having the opportunity to step into a technical and industrial field and prove that there is a place for women in every sector.

For me, Emirati Women’s Day is a celebration of how far we have come, but also a reminder of the opportunities ahead. The support and vision of the UAE leadership, together with the efforts of Her Highness Sheikha Fatima bint Mubarak, have helped create a generation of Emirati women who are confident to pursue their goals and make a difference. I believe the next step is to continue encouraging young Emirati women to explore fields they may not traditionally consider. When women are given the opportunity to learn, lead, and contribute, they do not only build successful careers — they help build a stronger and more sustainable future for the UAE.

Tech Features

How to Make Data Work for Agentic AI in the GCC

Published

3 days ago

August 19, 2026

Integrator Web-Editor

By Tejas Mehta, Senior Vice President & General Manager, Middle East & Africa at Qlik

For decades, organizations have worked to use data to make better decisions and drive better outcomes. Data has become the lifeblood of business, and AI now has the power to unlock it in new ways. With AI adoption across GCC organizations surging from 62% in 2023 to 84% in 2025, the paradigm is shifting from dashboards and visual interfaces to AI-driven experiences.

But too much data is still stuck in silos, incomplete, and inaccurate. Many analytics workflows remain manual, which slows time to value, limits insight quality, and raises costs. This challenge is visible across the GCC, where rapid digital transformation agendas are generating vast volumes of data, but organizations still struggle to unify and operationalize it effectively.

A common misstep among organizations is assuming that more AI or better models alone will solve this problem. In reality, the gap is not in intelligence, but in how data, context, and workflows are connected. Without that foundation, even the most advanced AI will fall short of delivering meaningful business impact.

But what if AI could do more of the heavy lifting, safely and reliably?

That’s the promise of agentic AI, and it’s quickly becoming reality. Agentic AI can reason through multi-step problems, adapt its approach, and engage the right capabilities to achieve a goal with minimal human involvement. Done right, it accelerates insight, lowers costs, and allows teams to focus more on running the business rather than managing manual processes.

Rethinking AI in Practice

Today, we are seeing the emergence of AI systems capable of handling structured analytics, unstructured knowledge, anomaly detection, and decision support, all within a unified experience. More importantly, these systems are becoming interoperable, allowing organizations to integrate AI into existing tools and workflows rather than replacing them entirely.

This flexibility is crucial in the GCC, where enterprises often operate across hybrid environments and must balance innovation with governance, compliance, and data sovereignty requirements.

Overall, there are effectively two entry points into this new AI paradigm:

First, embedded AI experiences within enterprise platforms are enabling faster, more contextual insights, grounded in trusted data and existing business logic.

Second, open integration layers are allowing organizations to connect AI capabilities into the assistants and environments they already use, ensuring flexibility while maintaining governance and control.

Making Data Work for AI

To move from fragmented data and isolated AI initiatives to true agentic systems, organizations need a clear operating model that connects data, insights, and action. This is where three practical priorities come into focus:

Achieve AI: Organizations need trusted, explainable insights embedded directly into workflows, while maintaining governance and context.
Accelerate AI: Many enterprises have already invested heavily in data models and business logic. The focus now is on building on that foundation to prove value quickly and scale efficiently.
Adapt AI: The future will not belong to a single assistant, vendor, or ecosystem. Interoperability will define success, allowing organizations to evolve without starting over.

Across the GCC, this adaptability is especially important as governments and enterprises push for AI leadership while maintaining flexibility to adopt global innovations.

Lessons from Early Adoption

Early adopters of agentic AI are already demonstrating tangible value.

A commercial leader can ask what changed in renewals this quarter, and immediately see the drivers, segments, and recommended next steps in one place.

An operations team can move from identifying a spike in service issues to understanding where it is concentrated, what factors are correlated, and what actions to prioritize, without switching between multiple tools.

A finance team can reconcile narrative and numbers while maintaining traceability, ensuring every insight is backed by clear evidence.

These use cases are highly relevant in the GCC, where sectors such as banking, telecom, and government are under increasing pressure to deliver faster, data-driven decisions while maintaining transparency and accountability.

A Regional Perspective on What Comes Next

AI conversation is moving beyond models. The real challenge lies in making AI dependable, explainable, and useful within the flow of work.

If organizations cannot connect analytics with knowledge, they don’t have agentic AI. They simply have automation without accountability.

For the GCC, where trust, governance, and strategic national initiatives play a central role, this distinction is critical. AI must not only be powerful; it must be responsible, transparent, and aligned with long-term economic visions.

Ultimately, the opportunity is clear: organizations that can successfully unify their data, embed intelligence into everyday workflows, and enable AI to act with context and accountability will define the next era of digital leadership in the region.