UNK_CraftyCamel Targets UAE Aviation and Infrastructure with Polyglot Malware

In fall 2024, a threat group tracked as UNK_CraftyCamel carried out a highly targeted cyberattack against a small number of organizations in the United Arab Emirates. The attackers compromised the email account of a legitimate Indian electronics supplier (INDIC Electronics) that had existing business relationships with the targets. Using that trusted account, they sent customized phishing emails containing a malicious ZIP file. The ZIP looked like routine business documents but hid a sophisticated multi-stage malware chain that ultimately installed a custom backdoor called Sosano on victims' computers. The campaign was discovered and reported by Proofpoint in February 2025.

The attack was carried out by a group Proofpoint tracks as UNK_CraftyCamel — a newly identified threat cluster. The group has not yet been formally attributed to a named state actor, but Proofpoint noted significant TTP overlaps with Iranian IRGC-aligned groups TA451 and TA455, which historically target aerospace and defense organizations. Broader infrastructure analysis by trusted partners also indicated possible connections with Iranian-aligned adversaries. Proofpoint currently tracks UNK_CraftyCamel as a separate, independent cluster from these groups.

The campaign's goal was espionage — gaining persistent, covert access to the networks of high-value organizations in the UAE's aviation, satellite communications, and transportation sectors. The Sosano backdoor installed on victims' machines gave the attackers the ability to browse files and directories, execute commands, and download additional payloads. The use of sophisticated obfuscation and an emphasis on staying hidden suggests the attackers had a clear mandate for long-term, stealthy intelligence collection rather than disruptive action.

The campaign was exceptionally narrow — Proofpoint identified fewer than five targeted organizations, all in the UAE. This precision is consistent with a state-directed intelligence operation with specific targets in mind, rather than a broad criminal campaign. Each phishing email was customized to its specific recipient, further demonstrating the operator's careful, targeted approach.

The targets were organizations in the UAE's aviation, satellite communications, and critical transportation infrastructure sectors. These industries sit at the intersection of national security and strategic economic interests — aviation and satellite communications provide intelligence on troop movements, logistics, and surveillance capabilities, while transportation infrastructure underpins the movement of people and goods across the region. For an actor aligned with Iranian state interests, access to these sectors would provide significant strategic intelligence about UAE and allied operations.

The attack chain was unusually complex. First, the attackers compromised a supplier's email account and sent targeted emails linking to a malicious ZIP file hosted on a lookalike domain. The ZIP appeared to contain normal business documents, but the files were polyglots — files engineered to appear as one format (like a PDF) while secretly containing a second format (like an HTA script or ZIP archive) that executes malicious code. Opening the fake XLS file triggered a chain: cmd.exe launched mshta.exe, which executed the hidden HTA script, which extracted and ran a loader called Hyper-Info.exe. That loader decoded a hidden file (disguised as a JPG image) using an XOR key to reveal the Sosano backdoor — a custom Golang malware — which then installed itself persistently and connected to the attacker's command-and-control server.

UAE aviation and satellite communications organizations are attractive targets because they hold sensitive operational data — flight routes, cargo manifests, satellite coverage maps, and communications infrastructure details — that have direct military and intelligence value. For an actor with suspected Iranian ties, the UAE represents both a geopolitical rival and a hub for US and allied military logistics in the region. Compromising these sectors could yield real-time intelligence on regional operations and provide strategic advantage in an ongoing geopolitical competition.