Have a question? +971 56 404 0503
News
The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers “Voldemort”
In August 2024, Proofpoint researchers identified an unusual campaign using a novel attack chain to deliver custom malware. The threat actor named the malware “Voldemort” based on internal filenames and strings used in the malware.
The attack chain comprises multiple techniques currently popular within the threat landscape as well as uncommon methods for command and control (C2), like the use of Google Sheets. Its combination of tactics, techniques, and procedures (TTPs), lure themes impersonating government agencies of various countries, and odd file naming and passwords like “test” are notable. Researchers initially suspected the activity may be a red team. However, the large volume of messages and analysis of the malware very quickly indicated it was a threat actor.
Proofpoint assesses with moderate confidence this is likely an advanced persistent threat (APT) actor with the objective of intelligence gathering. However, Proofpoint does not have enough data to attribute with high confidence to a specific named threat actor (TA). Despite the widespread targeting and characteristics more typically aligned with cybercriminal activity, the nature of the activity and capabilities of the malware show more interest in espionage rather than financial gain at this time.
Voldemort is a custom backdoor written in C. It has capabilities for information gathering and to drop additional payloads. Proofpoint observed Cobalt Strike hosted on the actor’s infrastructure, and it is likely that is one of the payloads that would be delivered.
Beginning on 5 August 2024, the malicious activity included over 20,000 messages impacting over 70 organizations globally. The first wave of messages included a few hundred daily but then spiked on 17 August with nearly 6,000 total messages.
Messages purported to be from various tax authorities notifying recipients about changes to their tax filings. Throughout the campaign, the actor impersonated tax agencies in the U.S. (Internal Revenue Service), the UK (HM Revenue & Customs), France (Direction Générale des Finances Publiques), Germany (Bundeszentralamt für Steuern), Italy (Agenzia delle Entrate), and from August 19, also India (Income Tax Department), and Japan (National Tax Agency). Each lure was customized and written in the language of the authority being impersonated.
Proofpoint analysts correlated the language of the email with public information available on a select number of targets, finding that the threat actor targeted the intended victims with their country of residence rather than the country that the targeted organization operates in or country or language that could be extracted from the email address. For example, certain targets in a multi-national European organization received emails impersonating the IRS because their publicly available information linked them to the US. In some cases, it appears that the threat actor mixed up the country of residence for some victims when the target had the same (but uncommon) name as a more well-known person with a more public presence. Emails were sent from suspected compromised domains, with the actor including the agency’s real domain in the email address.
The threat actor targeted 18 different verticals, but nearly a quarter of the organizations targeted were insurance companies. Aerospace, transportation, and university entities made up the rest of the top 50% of organizations targeted by the threat actor.
Proofpoint does not attribute this activity to a tracked threat actor. Based on the functionality of the malware and collected data observed when examining the Sheet, information gathering was one objective of this campaign. While many of the campaign characteristics align with cybercriminal threat activity, we assess this is likely espionage activity conducted to support as yet unknown final objectives.
The Frankensteinian amalgamation of clever and sophisticated capabilities, paired with very basic techniques and functionality, makes it difficult to assess the level of the threat actor’s capability and determine with high confidence the ultimate goals of the campaign. It is possible that large numbers of emails could be used to obscure a smaller set of actual targets, but it’s equally possible the actors wanted to genuinely infect dozens of organizations. It is also possible that multiple threat actors with varying levels of experience in developing tooling and initial access worked on this activity. Overall, it stands out as an unusual campaign.
The behavior combines a variety of recently popular techniques observed in several disparate campaigns from multiple cybercriminal threat actors that have used similar techniques as part of ongoing experimentation across the initial access ecosystem. Many of the techniques used in the campaign are observed more frequently in the cybercriminal landscape, demonstrating that actors engaging in suspected espionage activity often use the same TTPs as financially motivated threat actors.
While the activity appears to align with espionage activity, it is possible that future activities associated with this threat cluster may change this assessment. In that case, it would indicate cybercriminal actors, while demonstrating some typical e-crime delivery characteristics, used customized malware with unusual features currently only available to the operators and not abused in widespread campaigns, as well as very specific targeting not normally seen in financially motivated campaigns.
Defense against observed behaviors includes restricting access to external file sharing services to only known, safelisted servers; blocking network connections to TryCloudflare if it is not required for business purposes; and monitoring and alerting on use of search-ms in scripts and suspicious follow-on activity such as LNK and PowerShell execution.
Proofpoint reached out to our industry colleagues about the activities in this report abusing their services, and their collaboration is appreciated.
Staying hydrated just got easier, and greener, thanks to Ourwatr, that’s launching a nationwide free mineral water programme starting June 2025. It’s a first in the region: clean, refreshing mineral water made freely available across the country, delivered through a unique model that blends sustainability, community care, and social impact.
From metro stations and shopping malls to parks and government offices, thousands of chilled bottles of mineral water, sourced locally from Dibba, Fujairah, will soon be within everyone’s reach, every day. Ourwatr’s mission is simple: hydration is a right, not a privilege.
“At Ourwatr, we believe that drinking water should be accessible to all,” says Abhinav Murali, Co-founder.
“That’s why we’re giving away premium mineral water for free, and every bottle supports communities in need. It’s hydration with heart, proudly made right here in the UAE.”
Stamp of UAE quality
All Ourwatr bottles carry the prestigious EQM (Emirates Quality Mark) certification, guaranteeing they meet strict UAE national and international quality standards. When you grab a bottle, you’re assured of top-quality water, safe, pure, refreshing and approved by the country’s standardisation authority.
Mission in a bottle
With temperatures rising across the UAE, especially during summer, access to clean drinking water is more important than ever, for workers, families, children, and the elderly alike.
“In our desert climate, hydration isn’t just healthy; it’s life-saving,” adds co-founder Bharath Mohan.
“Each bottle we provide is a small act of kindness toward our community.”
Ourwatr is more than just a startup, it’s a mission in a bottle. Launched by three young, UAE-based entrepreneurs, the idea was sparked by a simple but powerful observation: access to free, convenient hydration isn’t always a given.
Wanting to change that, the trio built a business with heart at its core. The team is also in talks with various UAE charitable organisations and government agencies to expand its reach and impact. For every bottle distributed, a portion will be donated to local charities, turning everyday hydration into a meaningful act of giving.
A Model Built on Purpose and Sustainability
Ourwatr isn’t just about water, it’s about doing good. Instead of selling to consumers, the company partners with brands and organisations who cover the production and distribution costs. In return, sponsors co-brand the bottles, using them as a platform to share positive messages and shared values, while making a real difference.
“Sustainability isn’t just about less waste, it’s about creating lasting, meaningful change,” explains Sharat Nair, Co-founder.
The bottles are crafted from recyclable materials, aligning with the UAE’s zero-waste goals and green agenda.
Backing UAE Vision 2030
Ourwatr’s initiative supports the UAE’s Vision 2030 goals around health, sustainability, and quality of life. The startup is already collaborating with local authorities to expand water access and reach as many people as possible.
More than just water, Ourwatr is delivering hope, equality, and care, one bottle at a time.
Ardee Developments has announced the launch of sales for Fairmont Residences Al Marjan Island, its highly anticipated branded residential offering in partnership with Fairmont Hotels & Resorts.
Official sales will commence on 1 June 2025 with expression of interest starting 15 May 2025, marking a major milestone in the evolution of Ardee Al Marjan Island, the company’s flagship, multi-billion-dirham development set to redefine coastal living in Ras Al Khaimah.
Fairmont Residences Al Marjan Island will comprise 523 upscale residences — including apartments, townhouses, and sea villas — ranging from one to six bedrooms and spanning 86 m² to over 300 m². Every home is thoughtfully designed to embody refined beachfront living, with uninterrupted sea views and elegant interiors that reflect timeless sophistication.
Bringing together the prestige of the Fairmont brand with the ease of resort-style living, residents will enjoy exclusive access to a private beach, the Fairmont Fit Fitness Centre and Studio, family & kids pool, adults sky pool & terrace & bar, dedicated boardroom and private dining room, resident’s owners lounge as well as wellness facilities including treatment rooms, screening room, games room, kids club and seamless connectivity to the adjacent Fairmont resort.
Further enriching the offering is a tailored suite of à la carte services. From in-home catering and private chef experiences to childcare, dog walking, housekeeping, personal concierge support, and a home maintenance program while residents are away, every element is designed to simplify and enhance everyday living. In addition, residents will enjoy exclusive access to the Accor Owner Benefits Program. This includes Diamond status in the Accor Live Limitless (ALL) programme, the ability to gift Gold status to family and friends, and VIP privileges at over 5,700 hotels and resorts around the world.
With prices starting from AED 2.49 Million, Fairmont Residences Al Marjan Island offers an exclusive opportunity for discerning buyers seeking long-term value, effortless luxury, and a lifestyle defined by exceptional quality in one of the region’s most iconic coastal destinations.
Beyond the residences, guests were given an exclusive look at the next phase of the Ardee Al Marjan Island masterplan. The development is progressing into a fully integrated coastal destination that blends residences, hospitality, leisure, retail, and entertainment on an unprecedented scale.
Key components of the masterplan include branded and serviced residences, private villas, townhouses, a flagship luxury hotel, and a vibrant retail and F&B promenade. The destination will also feature a variety of curated lifestyle offerings — from wellness hubs and gaming lounges to family entertainment zones and waterfront experiences — all designed to create a future-ready, immersive community.
Prioritizing walkability, nature access, and sea connectivity, the project will boast expansive green spaces, direct beach access, and panoramic views, setting a new standard for contemporary island living in Ras Al Khaimah.
Vishal Mehta, CEO of Ardee Developments, added: “As we prepare to open sales of Fairmont Residences Al Marjan Island this June, we are proud to invite buyers into a community that reflects excellence at every level. In partnership with Al Marjan Island, Fairmont Hotels, and Christie’s International Real Estate, we are shaping a new era of luxury coastal living in Ras Al Khaimah — one defined by world-class design, hospitality, and lifestyle, brought together in a truly integrated destination.”
To support global sales efforts, Ardee Developments has appointed Christie’s International Real Estate Ras Al Khaimah as the exclusive master agency. Christie’s will lead GCC and international outreach and client servicing, ensuring a seamless buyer journey.
“This is a vibrant and integrated coastal lifestyle community that combines natural beauty, unparalleled hospitality and leisure not seen in the area before,” said Jackie Johns and Dinesh Chhatwani, Managing Partners at Christie’s International Real Estate Ras Al Khaimah. “Ras Al Khaimah’s momentum as a global hospitality and investment hub, and its rapidly growing real estate market, makes it the ideal launchpad for Ardee Developments to execute its grand vision.”
MERED outlined its long-term investment plans and strategic vision for Saudi Arabia at Saudi Giga Projects 2025 in Riyadh. The event, a key platform aligned with Vision 2030, brought together government bodies, giga project leaders, and private sector executives to discuss development, contracting, and talent-building opportunities within the Kingdom’s fast-growing construction and real estate sectors. As part of MERED’s participation, CEO Michael Belton joined a fireside chat where he shared insights into the company’s market entry approach and growth plans for the Saudi market.
“The Kingdom’s rapid urban and infrastructure growth is reshaping residential demand and creating new opportunities for long-term development,” said Michael Belton, CEO of MERED. “Vision 2030 and ongoing economic diversification are driving strong demand across residential, retail, commercial, and hospitality sectors, supported by investor-friendly reforms. In major cities like Riyadh and Jeddah, we’re seeing increased interest in premium and luxury living, as well as growing demand for Class A office spaces that reflect the ambitions of a modern business environment. MERED is well-positioned to meet these changing market needs through high-quality, innovative developments that offer lasting value.”
Yazan Al-Khalidi, Chief Commercial Director at MERED, joined a panel alongside leading developers, consultants, and contractors to discuss workforce capabilities and the skills required to deliver Saudi Arabia’s giga projects efficiently and at scale. The Kingdom’s real estate sector is projected to contribute 10% to GDP by 2030, while non-oil economic activity now accounts for over 50% of national GDP. Knight Frank’s Saudi Report 2025 reveals that 93% of high-income Saudi nationals are actively seeking to buy property, reinforcing the country’s ambition to build a competitive luxury real estate market.
Alongside its growth plans in Saudi Arabia, MERED is supporting the development of future architectural talent in line with the region’s broader goal of equipping young people with in-demand skills. As part of this effort, the company is sponsoring a select group of students to attend the Pininfarina Architecture Summer School in Turin this July, through its partnership with the prestigious Pininfarina Academy, founded by the renowned Italian design house. The program offers hands-on training and exposure to international design practices, giving participants valuable experience they can apply to architectural projects across the region.
MERED’s participation underscores its broader commitment to supporting the Kingdom’s real estate ambitions through innovation, sustainability, and knowledge transfer. With a pipeline of projects already launched in Dubai and Abu Dhabi, including the 290-meter ICONIC Residences designed by Pininfarina, the brand is well-positioned to introduce high-end, future-ready developments to the Saudi market.
Nothing Launches flagship Nothing Phone (3) and Headphone (1) in theme with the Iconic Museum of the Future in Dubai
Metadome.ai Partners with VinFast to Redefine Automotive Retail, Design and Training with Groundbreaking AI and XR Solutions
Designing Hospitality Around the Modern Traveler’s Needs
-
Tech News12 months agoDenodo Bolsters Executive Team by Hiring Christophe Culine as its Chief Revenue Officer
-
Tech Interviews1 year agoNavigating the Cybersecurity Landscape in Hybrid Work Environments
-
VAR3 months agoMicrosoft Launches New Surface Copilot+ PCs for Business
-
Tech News1 year agoBrighton College Abu Dhabi and Brighton College Al Ain Donate 954 IT Devices in Support of ‘Donate Your Own Device’ Campaign
-
VAR11 months agoSamsung Galaxy Z Fold6 vs Google Pixel 9 Pro Fold: Clash Of The Folding Phenoms
-
Tech Features1 year agoThe Middle East to Lead with Next-generation Mission Critical Communication Advancement
-
Features1 year agoSecurity in the Cloud Age: Combating Risks with Hybrid Cloud Solutions
-
Editorial8 months agoCelebrating UAE National Day: A Legacy of Leadership and Technological Innovation