{"id":8085,"date":"2025-03-04T10:33:55","date_gmt":"2025-03-04T10:33:55","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/iranian-hackers-target-u-a-e-aviation\/"},"modified":"2025-03-04T10:33:56","modified_gmt":"2025-03-04T10:33:56","slug":"iranian-hackers-target-u-a-e-aviation","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/iranian-hackers-target-u-a-e-aviation\/","title":{"rendered":"Iranian Hackers Target U.A.E. Aviation"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 04, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cyber Espionage \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Security researchers have uncovered a sophisticated phishing campaign targeting a small number of entities in the United Arab Emirates, specifically in the aviation and satellite communications sectors, with the goal of delivering a previously unknown Golang-based backdoor known as Sosano.<\/p>\n

The campaign, detected by Proofpoint in late October 2024, is attributed to a threat actor tracked under the name UNK_CraftyCamel<\/strong>. This actor leveraged a compromised email account belonging to the Indian electronics company INDIC Electronics to send tailored phishing emails to fewer than five organizations in the UAE.<\/p>\n

A notable aspect of this campaign is the use of a trusted third-party compromise to gain credibility with the targets. The emails contained URLs pointing to a fake domain mim! ck-ing the Indian company, hosting a ZIP archive with an XLS file and two PDF files.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Proofpoint’s analysis reveals that the attack involves multiple polyglot files, including a Windows shortcut (LNK) file disguised as a Microsoft Excel document, and two PDF files that are actually polyglots containing an HTML Application (HTA) file and a ZIP archive, respectively.<\/p>\n

The LNK file launches cmd.exe, which then runs the PDF\/HTA polyglot file using mshta.exe, leading to the execution of the HTA script that unpacks the contents of the ZIP archive present within the second PDF.<\/p>\n

\n
\n\"Target
\n<\/a>\n<\/div>\n

The final payload is a Golang-based backdoor called Sosano, which is XORed with a specific string to decode and run. Sosano has limited functionality, allowing it to establish contact with a command-and-control (C2) server and await further commands.<\/p>\n

The backdoor’s capabilities include:<\/p>\n