Skip to main content
عربي
logo

NCSC-TAD-2505-001

Severity Level: Critical
Malware

Reference No.: NCSC-TAD-2505-001CVSS 0

FortiGuard Incident Response Team Detects Intrusion into Middle East Critical National Infrastructure

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

A cyber intrusion targeting Critical Infrastructure in the Middle East continued through February 2025. Attackers used stolen VPN credentials, web shells, and backdoors, including Havoc, HanifNet, HXLibrary, and NeoExpressRAT, to maintain access and bypass network segmentation. After containment, they attempted to regain access by exploiting vulnerable applications and conducting targeted phishing attacks.

Mitigation and Immediate Actions

  1. 01

    Require MFA for VPN and privileged accounts; rotate credentials.

  2. 02

    Strengthen segmentation and layered access controls.

  3. 03

    Regularly check internet-facing services for unauthorized changes and allow only approved applications to run.

  4. 04

    Use EDR and behavior monitoring to detect suspicious activity.

References