Camel-ouflage: UNK_CraftyCamel’s Sneaky Cyber Espionage in UAE Unveiled!
Proofpoint warns that UNK_CraftyCamel, an Iranian actor, has targeted UAE sectors with a sneaky polyglot file trick. The campaign uses a new backdoor called Sosano, which naps before it acts—proving even malware needs a break. The attack likely aligns with IRGC interests. Watch out, UAE: the camel’s gone crafty!
Hot Take:
It seems the “Crafty Camel” has galloped out of nowhere, bringing a hump of trouble to the UAE. Just when you thought camels were only for desert rides, this one’s packing polyglot files and backdoors. Who knew cyber-espionage could have a camel motif? Watch out, this one’s got humps of stealthy tricks up its sleeve.
Key Points:
– UNK_CraftyCamel is a newly tracked Iranian threat actor targeting UAE organizations.
– The campaign uses polyglot files to disguise malicious payloads, which is a unique espionage technique.
– The backdoor, dubbed Sosano, is written in Golang and can execute various commands.
– Sosano attempts to contact a command-and-control server to receive further instructions.
– The campaign’s tactics align with known Iranian threat actors, potentially linked to IRGC.