Middle East Archives

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

AppWizard

September 5, 2026

Nvidia: DLSS 5 Is Coming to RTX 4000 GPUs, Too

Nvidia has announced that DLSS 5 technology will be available for RTX 4000 GPUs, previously exclusive to RTX 5000 GPUs. The official rollout will follow Nvidia's schedule for local stockists in the UAE, Saudi Arabia, and the Middle East, with performance tuning dependent on software updates later this year. Currently, DLSS 5 is only available in NBA 2K27, and while it enhances graphics, it can significantly reduce frame rates by 50% to 60%. Nvidia plans to optimize DLSS 5 for both RTX 5000 and RTX 4000 series. The gaming community has found unofficial ways to run DLSS 5 on RTX 4000 GPUs, but this also results in a substantial drop in FPS. Gamers in the Middle East won't need to upgrade their hardware to access DLSS 5, but they should monitor local hardware availability and updates for improved performance.

Tech Optimizer

September 2, 2026

Gen Digital stock dips after valuation call amid steady cybersecurity momentum

Gen Digital stock (ISIN US3687361044) traded at 30.02 dollars on September 1, 2026, reflecting a 3.2 percent decline from the previous close. The stock is within a 52-week trading range of 17.78 to 31.29 dollars, currently less than 4 percent below the 52-week high of 31.29 dollars. The intrinsic GF Value for the shares is estimated at 33.22 dollars, indicating the current price is 9.6 percent below this fair value. The stock has increased approximately 69 percent from its 52-week low of 17.78 dollars. Gen Digital introduced the Fearless Planet Index, showing North America with an average digital risk score of 29.6 percent, Europe at 28.5 percent, Asia-Pacific at 27.4 percent, the Middle East and Africa at 25.6 percent, and Latin America at 22.0 percent. The stock is quoted at 30.02 dollars on Nasdaq as of September 1, 2026.

Tech Optimizer

July 27, 2026

Hackers are hiding malware behind AI agents that antivirus cannot see

Sergey Lozhkin, head of Kaspersky’s global research and analysis team for the Asia-Pacific, Middle East, Turkey, and Africa, reported an increase in malware injection attacks targeting AI agents, particularly from outside an organization’s network. He noted that traditional signature-based analysis is becoming ineffective as AI skills operate in the cloud, connecting to external resources. Dmitry Galov, leading Kaspersky’s research for Russia and the CIS, emphasized the importance of behavioral analysis and sandboxing AI applications to combat these threats. Lozhkin warned that the rapid growth of skills and plugins requires organizations to adopt innovative security measures, as old models are no longer sufficient.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Tech Optimizer

July 6, 2026

Why most AI projects fail: It’s infrastructure and people

AI technology faces significant criticism for its low success rates in delivering business results, with studies indicating a 95% failure rate for enterprise AI solutions and only 9% of organizations in Europe, the Middle East, and Africa achieving measurable outcomes from AI initiatives. Four main shortcomings hinder the transition of AI prototypes to production: 1. Deployment Flexibility: Prototyping environments often lack the necessary flexibility for large-scale production deployment, particularly in regulated sectors. 2. Data Sovereignty: Production transitions can complicate data sovereignty at enterprise and regional levels. 3. Reliability: High availability is crucial for production environments, but vendor-managed platforms may not guarantee seamless upgrades or hardware swaps without downtime. 4. Disconnect in Tool Selection: Developers often choose tools for prototyping without considering production implications, leading to difficulties in scaling. The shortage of database administrators (DBAs) is exacerbated by the increasing use of AI tools, with 84% of developers utilizing them according to a 2025 survey. To address these challenges, Merrick suggests leveraging AI DBA agents to support human DBAs and improve database management efficiency. He emphasizes the need for both robust data infrastructure and enhanced operational support to improve the success rates of AI prototypes.

AppWizard

June 16, 2026

Malaysia’s AI agent-powered messaging app Respond.io raises $62.5M, eyes acquisitions

In 2017, Respond.io was founded to help businesses adapt to customer shifts towards messaging applications. It is headquartered in Kuala Lumpur and recently raised million in a Series B funding round, following a million Series A round in 2022. The company reported an annual recurring revenue (ARR) of million, a 169% year-over-year increase, with a 30% profit margin. Co-founders include Gerardo Salandra (CEO), Hassan Ahmed (CTO), and Yaroslav Kudritskiy (COO), who initially started the company in Hong Kong before relocating to Malaysia. Respond.io's platform caters to mid- to large-sized B2C enterprises, facilitating customer interactions across various messaging channels and utilizing AI for efficiency. The target market consists of "high-consideration" businesses, with an ideal customer profile of companies having 200 to 10,000 employees. Respond processes 2 billion messages quarterly and has a unique pricing model based on conversation volume rather than per user. The company emphasizes a data flywheel effect that enhances AI capabilities through increased message volume. Plans for growth include hiring, organic expansion, and strategic acquisitions, particularly in Europe and North America, which are projected to become larger revenue segments. Currently, revenue is distributed with 30% from APAC, 30% from Latin America, and 20% from the Middle East and Africa, with the remaining 20% from North America and Western Europe. Salandra expressed a cautious approach to growth and aspirations for a future public offering on Nasdaq.

AppWizard

June 13, 2026

Is Facebook Down? Users Report Issues with App

On Friday, Meta's Facebook and Instagram experienced a global outage, impacting millions of users who faced issues such as blank feeds, error messages, and repeated login failures across various regions, including the U.S., Europe, Asia, and the Middle East. The outage affected Facebook's desktop site, mobile app, Messenger, and components of Instagram's feed and login systems. Users reported being logged out unexpectedly, encountering incorrect password messages, and experiencing server errors. Meta acknowledged the situation and was working on a resolution. Specific failures included issues with login systems, blank news feeds, unexpected Messenger logouts, and difficulties accessing both desktop and mobile apps. Instagram users reported frozen feeds, inability to refresh content, failed logins, and delayed or disappearing direct messages. The outage typically resolves within one to three hours, and by approximately 10:30 a.m. ET, reports indicated a decline in issues affecting Meta's platforms.