WINTAPIX: New Kernel Driver Targets Middle Eastern Countries

Fortinet researchers discovered a sophisticated Windows kernel driver called WINTAPIX, suspected to be developed by Iranian threat actors, that has been targeting Internet Information Services (IIS) web servers in Saudi Arabia, Jordan, Qatar, and the United Arab Emirates since at least mid-2020. The malware went largely undetected for years before activity spikes in 2022 and 2023 prompted investigation. WINTAPIX installs itself at the kernel level and uses the Donut shellcode framework to inject an obfuscated .NET backdoor into IIS server processes, giving the operators persistent remote access and traffic proxying capabilities.

Fortinet attributes WINTAPIX to Iranian threat actors based on the targeting profile and tooling. Attribution has since evolved: some security sources link the activity to the Agrius group, while a November 2023 Check Point report on Scarred Manticore references WINTAPIX as part of that actor's broader IIS-targeting campaign across the Middle East. The exact group responsible has not been definitively confirmed, but Iranian state involvement is consistently assessed across multiple sources.

WINTAPIX is designed for long-term espionage and intelligence collection. Its backdoor functionality gives operators persistent access to compromised IIS servers — enabling them to monitor traffic, execute commands, exfiltrate data, and tunnel network communications through the infected server. The proxy capability in particular suggests the operators may also use compromised servers as relay infrastructure for other operations, consistent with Iranian state espionage priorities in the Gulf region.

The campaign has been active since at least mid-2020, making it a multi-year operation spanning over three years. Targeting is concentrated in four Middle Eastern countries: Saudi Arabia (the primary target), Jordan, Qatar, and the United Arab Emirates. The consistent focus on Gulf states aligns with Iranian geopolitical interests in monitoring regional rivals and adversaries. Activity spikes in 2022 and 2023 suggest the campaign remains active and ongoing rather than a historical operation.

WINTAPIX specifically targets organizations running Microsoft IIS web servers, which are commonly deployed by government agencies, enterprises, and critical infrastructure operators in the region. Given the four countries targeted and the state-sponsored nature of the campaign, government entities, public sector organizations, and large enterprises with IIS-hosted web applications are at highest risk. Any organization running IIS infrastructure in Saudi Arabia, Jordan, Qatar, or the UAE should consider themselves a potential target.

WINTAPIX gains access through IIS servers and installs itself as a Windows kernel-mode driver, registering as a service via registry modifications to ensure it runs on every system boot. The driver uses the open-source Donut framework to generate shellcode, which is injected into a running IIS worker process. This shellcode then loads an obfuscated .NET payload in memory — protected by SmartAssembly and Eazfuscator to resist analysis. The driver itself is shielded with VMProtect, which converts its code into a virtualized format to defeat reverse engineering. Together, these layers give the operators a deeply embedded, hard-to-detect implant with full backdoor and proxy functionality.

IIS servers are attractive targets because they are often internet-facing, handle sensitive web traffic, and run with elevated privileges on Windows systems. In the Gulf region, IIS is widely used by government portals, enterprise web applications, and critical infrastructure operators — making compromised IIS servers valuable both for intelligence collection and as relay nodes for further operations. The kernel-level persistence WINTAPIX achieves on IIS hosts gives operators long-term, difficult-to-evict access to high-value targets.