Iranian Hackers Used Compromised Indian Firm’s Email to Target U.A.E. Aviation Sector
Threat hunters are drawing attention to a new, highly focused phishing campaign that delivered a Golang backdoor known as Sosano, which was previously unreported, by targeting "fewer than five" companies in the United Arab Emirates (U.A.E.).
When Proofpoint discovered the malicious activity in late October 2024, it was specifically targeting satellite communications and aviation companies. The new cluster, known as UNK_CraftyCamel, is being monitored by the enterprise security company.
One significant element of the attack chain is that the adversary sent phishing messages by using its access to a compromised email account that belonged to INDIC Electronics, an Indian electronics company read more about Iranian Hackers Used Compromised Indian Firm's Email to Target U.A.E. Aviation S...