Tech Features

In the Crosshairs of APT Groups: A Feline Eight-Step Kill Chain

Published

2 years ago

June 27, 2024

By Alexander Badaev, Information security threat researcher, Positive Technologies Expert Security Center and Yana Avezova, Senior Research Analyst, Positive Technologies

In cybersecurity, “vulnerability” typically evokes concern. One actively searches for it and patches it up to build robust defenses against potential attacks. Picture a carefully orchestrated robbery, where a group of skilled criminals thoroughly examines a building’s structure, spots vulnerabilities, and crafts a step-by-step plan to breach security and steal valuables. This analogy perfectly describes the modus operandi of cybercriminals, with the “kill chain” acting as their detailed blueprint.

In a recent study, analysts from Positive Technologies gathered information on 16 hacker groups attacking the Middle East analyzing their techniques and tactics. It is worth noting that most of the threats in Middle Eastern countries come from groups believed to be linked to Iran—groups such as APT35/Charming Kitten or APT34/Helix Kitten. Let’s see how APT groups operate, how they initiate attacks, and how they develop them toward their intended targets.

Step 1: The Genesis of Intrusion (Attack preparation)

It all begins with meticulous planning and reconnaissance. APT groups leave no stone unturned in their quest for vulnerable targets. They compile lists of public systems with known vulnerabilities and gather employee information. For instance, groups like APT35 aka Charming Kitten known for targeting mainly Saudi Arabia and Israel, gather information about employees of target organizations, including mobile phone numbers, which they leverage for nefarious purposes like sending malicious links disguised as legitimate messages. After reconnaissance, they prepare tools for attacks, such as registering fake domains and creating email or social media accounts for spear phishing. For example, APT35 registers accounts on LinkedIn and other social networks to contact victims, persuading them through messages and voice calls to open malicious links.

Step 2: The Initial Access: Gaining a Foothold

Once armed with intelligence, cybercriminals proceed to gain initial access to their target’s network. Phishing campaigns, often masquerading as legitimate emails, serve as the primary means of infiltration. An example is the Desert Falcons group, observed spreading their malware through pornographic phishing. Notably, some groups go beyond traditional email phishing, utilizing social networks and messaging platforms to lure unsuspecting victims, as seen with APT35, Bahamut, Dark Caracal, and OilRig. Moreover, techniques like the watering hole method, where attackers compromise trusted websites frequented by their targets, further highlight the sophistication of these operations. Additionally, attackers exploit vulnerabilities in resources accessible on the internet to gain access to internal infrastructure. For example, APT35 and Moses Staff exploited ProxyShell vulnerabilities on Microsoft Exchange servers.

Step 3: Establishing Persistence: The Art of Concealment

Having breached the perimeter, APT groups strive to establish a foothold within the victim’s infrastructure, ensuring prolonged access and control. This involves deploying techniques such as task scheduling, as seen in the campaign against the UAE government by the OilRig group, which created a scheduled task triggering malicious software every five minutes. Additionally, many malicious actors set up malware autostart, like the Bahamut group creating LNK files in the startup folder or Dark Caracal’s Bandook trojan. Some APT groups, such as APT33, Mustang Panda, and Stealth Falcon, establish themselves in victim infrastructures by creating subscriptions to WMI events for event-triggered execution. Furthermore, attackers exploit vulnerabilities in server applications to install malicious components like web shells, which provide a backdoor for remote access and data exfiltration.

Step 4: Unraveling the Network: Internal Reconnaissance

After breaking in, APT groups don’t just sit there. They explore the system like a thief casing a house to find valuables and escape routes. This digital reconnaissance involves several steps. First, they perform an inventory check, identifying the computer’s operating system, installed programs, and updates, like figuring out a house’s security measures. For instance, APT35 might use a simple command to see if the computer is a powerful 64-bit system, capable of handling more complex tasks. Second, they map the network layout, akin to identifying valuable items and escape routes. APT groups might use basic tools like “ipconfig” and “arp” (like Mustang Panda) to see how devices are connected and communicate. They also search for user accounts and activity levels, understanding who lives in the house (figuratively) and their routines. Malicious tools, like the Caterpillar web shell used by Volatile Cedar, can list all usernames on the system. Examining running programs is another tactic, like checking for security guards. Built-in commands like “tasklist” (used by APT15 and OilRig) can reveal a list of programs currently running.

Finally, APT groups might deploy programs that hunt for secrets hidden within files and folders, like searching for hidden safes or documents. The MuddyWater group, for example, used malware that specifically checked for directories or files containing keywords related to antivirus software. By gathering this comprehensive intel, APT groups can craft targeted attacks, steal sensitive data like financial records or personal information, or exploit vulnerabilities in the system to cause even more damage.
Step 5: Harvesting Credentials: Unlocking the Vault

Access to privileged credentials is the holy grail for cyber attackers, granting them unrestricted access to critical systems and data. One common tactic is “credential dumping,” where tools like Mimikatz (used by APT15, APT33, and others) snatch passwords directly from a system’s memory, similar to stealing a key left under a doormat. Keyloggers, used by APT35 and Bahamut for example, acts like a hidden camera, silently recording keystrokes to capture usernames and passwords as victims type them in.

These stolen credentials grant access to even more sensitive areas. APT groups also exploit weaknesses in how passwords are stored. For instance, some target the Windows Credential Manager (like stealing a notepad with written down passwords). Brute-force attacks, trying millions of combinations, can crack weak passwords. Even encrypted passwords can be vulnerable if attackers have specialized tools. By employing these tactics, APT groups bypass initial security and access sensitive information or critical systems.

Step 6: Data Extraction: The Quest for Valuable Assets

Once inside, APT groups aren’t shy about snooping around. They leverage stolen credentials to capture screenshots, record audio and video (like hidden cameras and microphones), or directly steal sensitive files and databases. For instance, the Dark Caracal group employed Bandook malware, which can capture video from webcams and audio from microphones. This stolen data becomes their loot.

To ensure a smooth getaway, APT groups often employ encryption and archiving techniques. Imagine them hiding their stolen treasure chests—the Mustang Panda group, for example, encrypted files with RC4 and compressed them with password protection before shipping them out. This makes it difficult for defenders to identify suspicious activity amongst regular network traffic.

Step 7: Communication Channels: Establishing Control

APT groups rely on hidden communication channels with command-and-control (C2) servers to control infected machines and exfiltrate data. They employ various tactics to blend in with regular network traffic. This includes using common protocols (like IRC or DNS requests disguised as legitimate web traffic) and encrypting communication for further stealth.

However, some groups take it a step further. For instance, OilRig used compromised email servers to send control messages hidden within emails and then deleted them, making their C2 channel nearly invisible. These innovative techniques make it difficult for security measures to detect malicious activity, highlighting the importance of staying informed about evolving APT tactics.

Step 8: Covering Tracks: Erasing Digital Footprints

As the operation ends, APT groups meticulously cover their tracks to evade detection and prolong their presence in the compromised environment. Techniques like file obfuscation, masquerading, and indicator removal are employed to erase digital footprints and thwart forensic investigations. For example, the Bahamut group used icons mimicking Microsoft Office files to disguise malware, and the OilRig group used .doc file extensions to make malware appear as office documents. The Moses Staff group named their StrifeWater malware calc.exe to make it look like a legitimate calculator program.

To further bypass defenses, attackers often proxy the execution of malicious commands using files signed with trusted digital certificates. The APT35 group used the rundll32.exe file to execute the MiniDump function from the comsvcs.dll system library when dumping the LSASS process memory. Meanwhile, the Dark Caracal group employed a Microsoft Compiled HTML Help file to download and execute malicious files. Many APT groups also remove signs of their activity by clearing event logs and network connection histories, and changing timestamps. For instance, APT35 deleted mailbox export requests from compromised Microsoft Exchange servers. This meticulous cleaning makes it much more difficult for cybersecurity professionals to conduct post-incident investigations, as attackers often remove their arsenal of software from compromised devices after achieving their goals.

Conclusion: A Call to Vigilance

In a nutshell, the threat landscape in the Middle East is fraught with peril, as APT groups continue to refine their tactics and techniques to evade detection and wreak havoc on unsuspecting organizations. By understanding the anatomy of cyber intrusions and remaining vigilant against emerging threats, organizations can bolster their defenses and mitigate the risks posed by these sophisticated adversaries. Together, let us remain steadfast in our commitment to safeguarding the digital frontier against cyber threats.

Research Link

Tech Features

WHY EXCEPTIONS, NOT INVOICES, ARE COSTING FINANCE TEAMS THE MOST

Published

4 days ago

July 29, 2026

Integrator Web-Editor

By Ionut Valentin Sas, SVP Finance, UiPath

Across the GCC, processing standard invoices has become relatively straightforward. Routine invoices are no longer the problem. The real bottleneck begins the moment an invoice falls outside the expected workflow, whether that is a mismatched PO, a missing approval, incorrect coding or a supplier query. From there, the process spills into email threads and spreadsheets, and finance teams pay for it in delayed cash flow, missed early payment discounts, strained supplier relationships and tied-up working capital. The invoice itself was never really the problem. The problem is what happens when it does not follow the usual pattern.

The Trouble with Exceptions

Straight-through processing, where an invoice moves from receipt to payment without human intervention, has been one of finance teams’ most effective ways to handle higher invoice volumes at lower cost. Companies like Canon have reported up to 90 percent STP for certain invoice types.

Yet according to Ardent Partners’ State of ePayables report, even top-performing AP teams only reach around a third. That gap reflects a shift already under way in accounts payable. As routine invoices increasingly process themselves, less time goes into verifying standard transactions, and more of the team’s effort shifts toward judgment, coordination and resolving what falls outside the pattern, such as invoices missing a PO, mismatched purchase orders, supplier follow-ups and approval bottlenecks.

Most automation was built for the predictable majority of transactions. The remaining cases still get routed back to people, with no system designed to resolve them faster or more consistently. Resolving an exception often means pulling information together from ERP systems, procurement platforms, contracts, past transactions and supplier communications before a decision can be made. The challenge is rarely a lack of information. It’s that the information sits across multiple systems and requires someone to piece it together before a decision can be made. That’s where most of the time is lost.

Invoicing in the UAE

The UAE’s move toward mandatory e-invoicing is one of the clearest signals of this shift. For many organisations, this transition will expose processes that have remained largely hidden while invoices were handled manually. Standardised, machine-readable invoices make routine processing easier, but they also shine a light on the exceptions that continue to require human intervention. As a result, organisations have an opportunity to redesign how those exceptions are managed, rather than simply digitising existing processes. The mandate requires structured, machine-readable invoices in place of the PDFs and spreadsheets many finance teams still rely on, and it is pushing organisations to take a hard look at how they handle exceptions today.

Compliance is only the starting point. The bigger opportunity is using this transition to modernise broader finance operations and rethink how exceptions get managed, not just to meet the regulatory deadline.

The Importance of Governance

As more of this resolution work shifts to AI agents, visibility, auditability and control become essential. Governance is not there to slow decisions down. It is what gives organisations the confidence to automate lower risk work while keeping higher risk decisions transparent, explainable and subject to human oversight. Done well, orchestration keeps people in charge of decisions, not just faster at processing them. That becomes increasingly important as finance teams automate larger parts of the invoice lifecycle. Confidence in AI comes not from removing people altogether, but from knowing when human judgement should remain part of the process.

The UAE’s e-invoicing mandate makes this need for governance harder to ignore. But governance should not be seen as a brake on AI adoption. It is what makes that adoption trustworthy.

The Shift Finance Leaders Must Make

The old mindset was to automate invoices. The new one is to resolve exceptions.

That is the shift finance leaders now need to make, treating exception management as the next frontier in finance automation rather than an afterthought bolted onto invoice processing. The foundation for that shift is orchestration, bringing people, systems and AI agents together around each exception instead of simply flagging it for someone to pick up later.

AI agents can do much of the groundwork before a person is even involved, gathering supporting information, analysing how similar cases were resolved in the past, recommending next steps and drafting supplier communications. That does not replace judgment. It means the judgment that does happen is faster and better informed. The organisations that gain the greatest advantage will not necessarily be those processing the highest number of invoices automatically. They will be those that can resolve exceptions quickly, consistently and with the right level of oversight, turning what has traditionally been a source of delay into a competitive advantage. The GCC built its reputation in digital government and public services by fixing what was not working, not by polishing what already was. Finance now has the same opportunity in front of it. The invoices were never the hard part. The exceptions are, and the organisations that get ahead of them will be the ones setting the pace for the next phase of digital invoicing in the region.

Tech Features

THE BEAUTIFUL GAME, FOR EVERYONE: HOW TECHNOLOGY REWROTE THE RULES OF FOOTBALL FANDOM

Published

3 weeks ago

July 15, 2026

Integrator Web-Admin

By: Jason Ou, President at Hisense MEA

As the FIFA World Cup 2026 final approaches this week, we reflect on a tournament that transformed how millions experienced the sport, from living room stadiums to quiet spaces in packed arenas

As we count down the final hours before this week’s showpiece final, the FIFA World Cup 2026 has delivered 103 matches across 16 cities, and with it, a reimagining of what “experiencing football” means. Hisense served as the official and exclusive Video Assistant Referee (VAR) Review TV Provider for the entire tournament across the United States, Canada, and Mexico. Every controversial offside call. Every penalty review that had fans screaming at their screens. Every red card confirmation that shifted the momentum of a knockout match. The technology referees used to make those match-defining decisions ran on Hisense RGB MiniLED displays. The Video Operation Room in Zurich was upgraded specifically with these screens because VAR officials needed “clear and authentic restoration of live match footage.”

And it delivered.

Two parallel revolutions unfolded across this tournament: one that transformed homes into legitimate viewing destinations, and another that finally opened stadium doors to millions who’d been locked out for decades.

Hisense made an argument before kickoff: the home viewing experience could, in some ways, surpass what you’d get at the stadium itself. If the technology was precise enough for officiating decisions scrutinized by billions and debated across social media within seconds, it was good enough for living rooms worldwide.

For those who invested in the L9Q TriChroma Laser TV, everyday living spaces became premium match-day destinations throughout the tournament. With ultra-large displays up to 200 inches, fans followed every run, pass, tackle, and goal with remarkable clarity.

The flagship UXS RGB MiniLED TV, powered by breakthrough RGB MiniLED technology that delivers exceptional color accuracy, brightness, and contrast, brought fans closer to every moment on the pitch and created a more immersive and lifelike viewing experience for sports, entertainment, and gaming.

The Party Everyone Could Finally Join

For millions of fans living with autism, PTSD, dementia, anxiety, and other sensory processing conditions, the stadium experience had remained firmly out of reach, a party they could hear from outside but never truly join. This tournament changed that.

At this year’s tournament, all 16 host stadiums featured dedicated sensory rooms, making this the first-ever Sensory Inclusive FIFA World Cup. Hisense collaborated with FIFA and KultureCity to install these spaces across every venue in the United States, Canada, and Mexico, and they were used.

As Hisense continues pushing boundaries, making every match feel bigger, every celebration more immersive, and every memory more unforgettable, one truth has emerged from this tournament: the hierarchy of World Cup viewing has been expanded, making room for everyone who loves the beautiful game.

This week, as billions watch the final from living rooms with 300-inch screens and fans with sensory needs take their seats in the stadium, football’s promise will be fulfilled. The beautiful game. Finally, for everyone.

Tech Features

HOW AI IS RESHAPING HIGHER EDUCATION, AND WHY UNIVERSITIES MUST REINVENT THEMSELVES

Published

3 weeks ago

July 15, 2026

Integrator Web-Admin

By: Prof. May El Barachi, Dean & Full Professor, University of Wollongong in Dubai

Artificial intelligence is no longer a future technology. It has become part of our everyday lives almost overnight. Whether we are writing emails, analysing data, generating code, creating presentations, or conducting research, AI has fundamentally changed how knowledge is created and consumed.

For higher education, this represents one of the biggest disruptions since the arrival of the internet.

Much of today’s conversation revolves around a simple question: Will AI replace educators?

I believe we are asking the wrong question.

The real question is whether universities can reinvent themselves quickly enough to prepare graduates for an AI-first world.

Having worked extensively with generative AI technologies, I see AI not as a replacement for education, but as an extraordinary opportunity to redefine it. From One-Size-Fits-All Learning to Personalized Education.

Traditional education has largely been built around standardized delivery: one lecturer, one classroom, one pace, and one curriculum for every student.

AI changes that equation.

For the first time, every learner can potentially have access to an intelligent learning companion available 24 hours a day. AI tutors can explain difficult concepts, generate additional practice exercises, adapt explanations to different learning styles, provide immediate feedback, and support students until genuine understanding is achieved.

Instead of asking students to adapt to education, education can finally adapt to students. This has important implications for accessibility, allowing high-quality learning experiences to reach individuals regardless of geography or socioeconomic background.

In many ways, AI has the potential to become the great equalizer in education.

Teaching Students How to Think; Not What to Memorize

At the same time, AI forces universities to rethink their educational philosophy.

When information is instantly accessible, memorization becomes less valuable.

Future graduates will be judged less by what they know, and more by how effectively they can solve problems, evaluate evidence, think critically, collaborate, communicate, and exercise sound judgement. This means assessment methods must evolve as well.

Rather than rewarding students for reproducing information that AI can generate in seconds, universities should increasingly emphasize authentic projects, real-world problem solving, teamwork, creativity, ethical reasoning, and applied learning. Ironically, AI may push higher education to become more human, not less.

Educators Are Becoming AI-Enabled Mentors

There is growing concern that AI will eventually replace lecturers. I see the opposite happening.

The educator’s role is becoming even more important; but it is changing.

Rather than acting primarily as transmitters of knowledge, educators are evolving into mentors, coaches, facilitators, and critical thinking partners who help students interpret information, challenge assumptions, and develop professional judgement.

To do that effectively, universities must invest heavily in AI literacy. Faculty need more than basic familiarity with AI tools. They must understand how these systems work, their limitations, their biases, and how they can be integrated responsibly into teaching, assessment, and research. AI literacy is rapidly becoming as fundamental as digital literacy was twenty years ago.

Preparing Graduates for an AI-First Workforce

Perhaps the biggest transformation is happening outside the classroom. Virtually every profession; from healthcare and finance to engineering, education, law, and government; is being reshaped by AI.

Graduates entering the workforce will collaborate with intelligent systems every day. This requires a new combination of technical and human capabilities. Understanding AI, data, automation, and digital technologies will become essential across disciplines. Equally important will be creativity, emotional intelligence, leadership, adaptability, ethical decision-making, and lifelong learning. The most successful professionals will not compete against AI. They will learn how to work alongside it.

Looking Ahead

The future university may look very different from today’s institution. Degrees are likely to become more modular and flexible, complemented by stackable micro-credentials that allow professionals to continuously update their skills throughout their careers.

Immersive technologies such as virtual and augmented reality will create richer learning experiences, while learning analytics will enable institutions to identify struggling students earlier and provide personalized support. Education will become increasingly global, connected, and lifelong.

The Human Advantage

Despite all these technological advances, one thing remains unchanged. Education has never been solely about transferring knowledge. It is about inspiring curiosity, building confidence, developing character, nurturing empathy, and preparing individuals to make meaningful contributions to society.

No algorithm can replace the inspiration of a great teacher or the mentorship that shapes a student’s future.

AI should not diminish the human element of education. It should amplify it.

The universities that thrive over the next decade will not be those that simply adopt AI tools. They will be those that successfully combine technological innovation with the uniquely human qualities that no machine can replicate. Because ultimately, the future of higher education is not about artificial intelligence. It is about human intelligence; enhanced by AI, guided by educators, and applied to solve the world’s most complex challenges.