Earth Simnavaz (APT34) Targeting UAE and Gulf Regions

Researchers at Trend Micro identified cyberattacks by Earth Simnavaz (also known as APT34 or OilRig), targeting UAE and Gulf region entities. The group exploits vulnerabilities, including CVE-2024-30088, to escalate privileges and deploy backdoors via Microsoft Exchange servers. Using tools like .NET malware, PowerShell scripts, and IIS-based threats, they aim to steal sensitive credentials and maintain persistence. The attackers leverage the remote management tool ngrok for covert control, posing ongoing risks to governmental and critical sectors.