CloudSek Report Warns of Iranian-Linked Cyber Pre-Positioning Across Gulf Networks

Apr 9, 2026 · Original article ↗

Summary

CloudSek describes alleged APT35 access across several Gulf networks, outlines Iranian-linked actors, malware and exploited vulnerabilities, and recommends urgent patching, IOC blocking, credential rotation and compromise assessments.

Key points

The article says APT35 had pre-positioned access in Jordan, the UAE, Saudi Arabia and Kuwait, linking earlier cyber activity with targets in the regional conflict.
It identifies APT35 tools including BellaCiao, Sagheb RAT and a Python webshell framework, and says leaked source code could help defenders create YARA rules.
Listed access routes include vulnerabilities in ScreenConnect, Exchange, Ivanti Connect Secure and Telerik, as well as compromised routers.
The article describes other Iranian-linked actors and alleged activity, including Handala Hack claims and a Shamoon 4.0 deployment affecting Saudi energy workstations.
Recommended immediate steps include blocking listed indicators, patching or isolating affected products, hunting for webshells and Plink.exe, and rotating administrator credentials.
Further recommendations include checking router fleets for DNS redirection, detecting suspicious TOR traffic, enforcing MFA and assessing potential compromise in Jordan, the UAE and Saudi Arabia.

Article Details

Attack Vectors: APT35 reportedly exploited CVE-2024-1709/1708 in ConnectWise ScreenConnect, CVE-2021-34473 in Microsoft Exchange, CVE-2024-21887 in Ivanti Connect Secure, CVE-2021-44228 in Java applications, and CVE-2019-18935 in Telerik .NET.
APT35 reportedly compromised more than 580 GoAhead, TP-LINK, ASUS, and D-Link router devices for DNS manipulation.
The article reports BellaCiao webshell deployment, with Windows service persistence; Plink.exe execution and Adminer.php or custom ASP/ASPX webshells are cited as hunting indicators.
Sagheb RAT reportedly uses TOR routing and XOR-encrypted HTTP traffic, and steals Firefox and Telegram credentials.
Handala Hack is reported to have attacked Jordanian infrastructure and breached Israeli healthcare; ICS disruption is claimed.
APT33 reportedly deployed Shamoon 4.0 to wipe 15,000 Saudi energy workstations.
Defensive Notes: Block the listed IOC domains and IP ranges at perimeter firewalls and DNS.
Patch ConnectWise ScreenConnect, Exchange affected by ProxyShell, Ivanti Connect Secure, and Telerik; isolate systems if patching is not possible.
Hunt for Plink.exe, Adminer.php, and custom ASP/ASPX webshells on internet-facing servers.
Rotate Domain Administrator credentials and audit administrator accounts created since January 2024.
Organizations in Jordan, UAE, or Saudi Arabia are advised to conduct an immediate compromise assessment.
Detect TOR circuit establishment from non-user processes and XOR-encrypted HTTP traffic; audit consumer routers for DNS redirection.
Enforce MFA and verify behavioral antivirus coverage, not only signature-based detection.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`1543[.]ir`	Identified as internal VoIP infrastructure.
DOMAIN	`aecars[.]store`	Identified as phishing infrastructure.
DOMAIN	`dreamy-jobs[.]com`	Identified as an APT35 counterintelligence honeypot domain.
DOMAIN	`gassam[.]su`	Identified as an Al-Qassam persona domain.
IPV4	`103[.]57[.]251[.]31`	Identified as an anonymisation proxy used in the operations.