DNSpionage Campaign Targets Lebanon and UAE Government Domains

In late 2018, Cisco Talos uncovered a two-part cyberattack targeting government organizations in Lebanon and the UAE, as well as Middle East Airlines. In the first part, attackers used fake job listing websites to deliver a custom backdoor called DNSpionage to victims' computers. In the second part, the same actor quietly redirected official government and airline domain names — email portals and VPN gateways — through their own servers, enabling silent interception of credentials and communications.

Cisco Talos did not attribute this campaign to a specific group. However, Mandiant subsequently linked the DNSpionage activity to APT34 (OilRig), an Iranian state-sponsored group, based on overlapping infrastructure and targeting patterns. The campaign's heavy focus on Lebanese and UAE government entities, as well as a private airline, is consistent with Iranian intelligence interests in the region. The Openminded incident response report on the same campaign also references the Mandiant APT34 link.

The campaign had two connected goals. The DNSpionage malware was designed to give attackers persistent remote access to infected systems for espionage and data collection. The parallel DNS redirection attacks were aimed at passively intercepting credentials, email communications, and potentially MFA codes from government employees and airline staff — without ever needing to compromise their devices directly. Together the two tracks suggest a broad intelligence collection operation targeting sensitive government communications.

The campaign was narrowly targeted but high-impact. Named DNS redirection victims included the Lebanese Finance Ministry, Abu Dhabi Police (VPN infrastructure), UAE Ministry of Government Services, the UAE Telecommunications Regulatory Authority, and Middle East Airlines — whose certificate covered 11 subdomains. Talos confirmed victims in both Lebanon and the UAE via DNS telemetry. The breadth of the DNS redirection across both the public and private sectors across two countries over two months indicates a well-resourced, deliberate operation rather than opportunistic attacks.

The campaign specifically targeted government agencies in Lebanon and the UAE, including finance, law enforcement, and telecommunications regulatory bodies. A private Lebanese airline (Middle East Airlines) was also targeted. The use of fake Wipro and Suncor Energy recruitment sites as lures suggests IT and energy sector employees were also in scope for the malware delivery track. The DNS redirection focused specifically on email and VPN infrastructure — services that carry high volumes of sensitive communications and credentials.

The attack used two methods simultaneously. For device compromise, attackers created fake job sites impersonating Wipro and Suncor Energy, hosting malicious Word documents. Opening the document triggered a macro that silently installed the DNSpionage backdoor — which communicated back to attackers either via HTTP requests to a fake Wikipedia page or via DNS queries with commands encoded in the subdomain names. For network-level interception, the attackers compromised DNS records of target government domains at the registrar or nameserver level, redirecting email and VPN traffic through their servers — after pre-generating matching SSL certificates so users would see no browser warnings. Anyone logging into their organization's email or VPN during the redirection period would have had their credentials captured.

Lebanese and UAE government ministries hold sensitive diplomatic, financial, and security communications that are directly valuable to Iranian state intelligence. Law enforcement and VPN infrastructure are particularly attractive because compromising them can expose both operational security details and employee identities. Middle East Airlines, as Lebanon's national carrier, handles travel records and communications that could assist in tracking individuals of intelligence interest. The targeting of email and MFA-protected systems specifically suggests the attackers wanted sustained, high-quality access to communications rather than one-off data theft.