Iranian Chafer APT Targets Kuwait and Saudi Arabia’s Critical Sectors

Bitdefender researchers documented two Chafer APT campaigns from 2018 targeting air transportation and government organizations in Kuwait and Saudi Arabia. The Kuwait operation was elaborate and lasted more than 18 months — attackers gained initial access, moved laterally across the network, created their own user accounts, and prepared for data exfiltration using tools including a custom RAT that communicated via Dropbox. The Saudi Arabia attack was simpler, with a user tricked into executing a malicious file directly. Both campaigns were attributed to Chafer APT, an Iranian-linked threat group active since 2014.

Chafer APT is an Iranian-linked cyberespionage group active since at least 2014. The group focuses on intelligence gathering against targets in the Middle East, particularly governments and critical infrastructure. Attribution is supported by tool overlaps with prior documented Chafer campaigns — shared PDB paths and compiler metadata link tools from these attacks to Remexi (mas.dll), a known Chafer backdoor previously documented by Symantec. The group's targeting of air transportation and government sectors in Kuwait and Saudi Arabia is consistent with Iranian state intelligence priorities in the region.

The primary goals were intelligence gathering and data exfiltration. In Kuwait, the attackers deployed Navicat Premium (a database management tool), SmartFTP Password Decryptor, and WinSCP — all tools consistent with exploring and extracting data from compromised systems. A custom RAT that exfiltrated files to Dropbox was also deployed. The attackers were thorough and patient, spending over 18 months inside the Kuwaiti network. The lack of conclusive network logs made it difficult to confirm exactly what data was taken, but the tool selection strongly indicates data exploration and exfiltration were the end goals.

Bitdefender identified victims in two countries: Kuwait (air transportation sector) and Saudi Arabia (government sector). The Kuwait operation was significantly more sophisticated and lasted more than 18 months. The Saudi Arabia attack appeared to be a simpler, more opportunistic operation — possibly abandoned when the attackers found no further exploitable machines after the initial compromise. The specific organizations were not named in the report, but both fit Chafer's established pattern of targeting critical infrastructure and government bodies in the Gulf region.

Air transportation and government organizations in Kuwait and Saudi Arabia were the confirmed targets. Air transportation is attractive because it controls critical national and regional logistics infrastructure, flight data, and communications — all valuable to an intelligence actor monitoring the movement of people and cargo across the Gulf. Government organizations hold sensitive policy and diplomatic communications. Both sectors represent high-value targets for Iranian intelligence collection given ongoing regional geopolitical tensions between Iran, Kuwait, and Saudi Arabia.

The Kuwait attack used a multi-stage chain. Initial access was likely via spearphishing with shellcode-laden documents running Metasploit reverse TCP payloads. From there, the attackers deployed CrackMapExec and Mimikatz variants to harvest credentials, then moved laterally using PsExec and RDP. They installed a modified Plink as a Windows service for tunneling and deployed custom proxy tools using SOCKS5 over HTTP to communicate with C2 servers. Python-based RATs used DNS and HTTP channels that disguised traffic to look like legitimate requests. A MechaFlounder-variant RAT communicated via Dropbox — each victim machine got its own Dropbox folder for receiving commands and uploading stolen files. The attackers created their own user accounts and operated almost exclusively on Fridays and Saturdays, avoiding detection during business hours. The Saudi Arabia attack was much simpler: a user was tricked into double-clicking a malicious file from their Downloads folder — the RAT executed twice within three minutes under the parent process explorer.exe, confirming it was user-initiated.

Gulf state air transportation and government organizations hold intelligence that directly serves Iranian state interests. Kuwait and Saudi Arabia are both regional rivals of Iran and host US and allied military assets — their government communications and infrastructure data are high-value collection targets. Air transportation data specifically reveals the movement of people, cargo, and logistics across the region, which has both military and economic intelligence value. The 18-month dwell time in the Kuwait network indicates the attackers were not in a hurry — they were systematically exploring and mapping the organization's data before exfiltrating.