Resecurity Says Nasir Security Targets Middle East Energy Suppliers
Summary
Resecurity describes Nasir Security as a likely Iranian-aligned actor targeting vendors and contractors serving Middle East energy firms. It says the group exaggerates stolen-data volumes and warns that authentic third-party documents could inform future attacks.
Key points
- Resecurity identifies Nasir Security as a likely Iranian-aligned actor targeting vendors and contractors that support Middle East energy companies.
- The group reportedly uses third-party access to obtain authentic corporate documents, while its claims of stolen data volumes may be exaggerated.
- Resecurity says Nasir Security claimed to have taken 413 GB from Dubai Petroleum and 827 GB from Oman CC Energy Development, but found those figures to be significant overstatements.
- Reported tactics include business email compromise, impersonation, exploitation of public-facing applications and insecure cloud storage, and credential harvesting.
- Resecurity warns that authentic infrastructure documents could help threat actors identify components whose damage would be difficult to repair.
- The company recommends increased third-party monitoring and rigorous vendor risk assessments.
Article Details
- Event Type
- Reported supply-chain cyberattacks and psychological operations targeting Middle East energy-sector vendors and contractors.
- Impact
- Resecurity reports that Nasir Security obtains authentic third-party documents and exaggerates the volume of data allegedly stolen. The documents could provide information useful for future destructive operations and potentially prolonged outages; the article does not report confirmed destructive damage.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of public-facing applications.T1566 · PhishingThe article says the group uses targeted spear phishing to gain access to contractor accounts.T1656 · ImpersonationThe article reports that the group impersonates legitimate entities to gain trust.
Threat Actors
Products
FortiEdge CloudCommon tactics include business email compromise, impersonation, exploitation of public-facing apps and insecure cloud storage, and credential harvesting from platforms like FortiGate Cloud and FortiEdge Cloud.FortiGate CloudCommon tactics include business email compromise, impersonation, exploitation of public-facing apps and insecure cloud storage, and credential harvesting from platforms like FortiGate Cloud and FortiEdge Cloud.
Countries
IraqSince emerging in late 2025, the group has followed a consistent pattern: long periods of silence followed by a flurry of claims targeting high-profile organizations in the UAE, Saudi Arabia, Oman, and Iraq.OmanSince emerging in late 2025, the group has followed a consistent pattern: long periods of silence followed by a flurry of claims targeting high-profile organizations in the UAE, Saudi Arabia, Oman, and Iraq.Saudi ArabiaSince emerging in late 2025, the group has followed a consistent pattern: long periods of silence followed by a flurry of claims targeting high-profile organizations in the UAE, Saudi Arabia, Oman, and Iraq.UAESince emerging in late 2025, the group has followed a consistent pattern: long periods of silence followed by a flurry of claims targeting high-profile organizations in the UAE, Saudi Arabia, Oman, and Iraq.
Industries
EnergyResecurity has identified Nasir Security, a likely Iranian-aligned threat actor that targets vendors and contractors supporting Middle East energy firms to conduct supply chain attacks and psychological operations.Oil and gasRather than attempting to breach the hardened perimeters of state-owned oil and gas giants directly, Nasir Security focuses its efforts on the smaller vendors, contractors, and engineering firms that support them.