Security News Suspected Iranian Hackers Used Compromised Indian Firm's Email to Target U.A.E. Aviation Sector

[Captain Awesome]

Content source

https://thehackernews.com/2025/03/suspected-iranian-hackers-used.html?m=1

Threat hunters are calling attention to a new highly-targeted phishing campaign that singled out "fewer than five" entities in the United Arab Emirates (U.A.E.) to deliver a previously undocumented Golang backdoor dubbed Sosano.

Suspected Iranian Hackers Used Compromised Indian Firm's Email to Target U.A.E. Aviation Sector

Hackers used a compromised Indian electronics firm’s email to deliver a Golang backdoor in a UAE-targeted phishing campaign.

thehackernews.com

 

[Andy Ful]

Enabling Smart App Control on Windows 11, or advanced Windows features (Windows Policies, AppLocker, SRP, WDAC) could prevent this concrete attack flow.

But, this probably would not stop the attackers, just as ATP features of AVs.
The attackers were highly motivated to compromise a few targets in "the United Arab Emirates with a distinct interest in aviation and satellite communications organizations, along with critical transportation infrastructure". In such a case it is always possible to bypass the protection, assuming that the attacker knows the details of applied security.

 

[Andy Ful]

According to Proofpoint, the security used by the targetted organizations was not at a high level:

Detection opportunities​

This malware infection chain offers a variety of opportunities for detection. They include, but are not limited to:

• LNK files executing from recently created or unzipped directories
• LNK files executing from a recently unzipped directory
• URL file in the Reg runkey
• URL file launching any file besides a web browser
• Executable file accessing a JPGfile from a user directory

 

[Andy Ful]

It is interesting why AVs do not block such CmdLines like:
C:\Windows\System32\cmd[.]exe /c "mshta.exe" %cd%\anyfile.pdf

A similar CmdLine was used in the initial shortcut of the attack. I do not believe any benign application would like to use Mshta LOLBin to open HTA files disguised as PDF files.