CyberShelter threat intelligence analysts have identified a sophisticated cyber-espionage campaign targeting the UAE’s aerospace, defence, and government ecosystem, leveraging VHD-delivered malware and spear-phishing themed around regional space industry events.

Advisory ID: TIA-UAE-2026-023
Published: 4 March 2026
Source: CyberShelter Threat Intelligence & NSOC
Classification: ???? CRITICAL SEVERITY

Executive Overview

CyberShelter Threat Intelligence has identified an active cyber-espionage campaign targeting strategic organizations within the UAE, including aerospace, defence contractors, and government entities.

The activity has been attributed with high confidence to Peach Sandstorm (APT33), an Iranian state-aligned threat group associated with the Islamic Revolutionary Guard Corps (IRGC).

The campaign, tracked as CandleStone, uses spear-phishing emails referencing the Abu Dhabi Space Debate to distribute malicious archives containing Virtual Hard Disk (VHD) containers, allowing attackers to bypass Windows security protections.

CyberShelter analysts warn that APT33 historically shifts from espionage operations to destructive cyber attacks, meaning this activity could represent an early stage of more disruptive operations.

Strategic Context

Why This Campaign Matters to the UAE

The UAE has rapidly positioned itself as a global aerospace innovation hub, highlighted by initiatives such as the Hope Probe Mars Mission and expanding defence technology programs.

These strategic developments have made UAE aerospace and defence organizations high-value intelligence targets for state-aligned cyber actors seeking technological advantage and geopolitical leverage.

Primary Target Sectors

Attack Chain Overview

The CandleStone campaign follows a structured multi-stage intrusion lifecycle designed to establish persistent access within enterprise environments.

Malware Toolkit Used in the Campaign

The attackers deploy a toolkit designed for persistence, reconnaissance, and credential harvesting across enterprise systems.

Delivery Mechanism: VHD-Based Security Bypass

Attackers use Virtual Hard Disk (VHD) containers to bypass Windows security protections known as Mark-of-the-Web (MotW).

When users mount the VHD file, Windows treats the files as local content, preventing security warnings normally triggered for internet downloads.

Files Observed in the Campaign

CandleStone Backdoor Technical Behavior

Once executed, the backdoor performs system reconnaissance and establishes encrypted communication with attacker infrastructure.

Host Reconnaissance Data Collected

• Hostname and logged-in username
• IPv4 and IPv6 network addresses
• System architecture details
• Running processes

Command-and-Control Communication

Communication occurs over HTTP on port 443, blending with legitimate encrypted traffic.

Command-and-Control Infrastructure

Threat actors leveraged UAE-themed typosquatting domains and aged infrastructure to evade reputation-based security filters.

Threat Actor Profile

Peach Sandstorm (APT33)

APT33 is an Iranian state-aligned cyber espionage group linked to the IRGC, active since 2013.

MITRE ATT&CK Mapping

Indicators of Compromise (IOC)

Organizations should immediately monitor and block the following indicators.

Immediate Defensive Actions

Organizations operating in strategic sectors should take the following actions immediately.

1️⃣ Block identified campaign domains
2️⃣ Restrict mounting of VHD/ISO disk images via GPO policies
3️⃣ Hunt for dxgi.dll loaded by ApplicationFrameworkHost.exe
4️⃣ Monitor endpoints for LNK execution from mounted disk images

Strategic Security Measures

• Conduct retrospective log analysis for the past 180 days
• Deploy YARA rules detecting CandleStone malware behavior
• Monitor ASN 395092 infrastructure activity
• Improve sandbox detonation for disk image files
• Increase employee awareness regarding conference-themed phishing

CyberShelter Strategic Assessment

The CandleStone campaign demonstrates a significant evolution in Iranian cyber operations, combining:

• VHD-based delivery mechanisms
• Pre-aged attack infrastructure
• DLL sideloading persistence techniques

Given APT33’s history of transitioning from espionage to destructive cyber operations, this campaign should be treated as a high-priority threat to UAE strategic sectors.

CyberShelter NSOC continues active monitoring and threat hunting across enterprise environments.

???? URGENT: Initiate incident response procedures immediately if indicators are detected.

Need Immediate Assistance?

CyberShelter NSOC provides 24/7 incident response, threat hunting, and advanced cyber defense support.

Contact CyberShelter NSOC immediately for assistance.