State-Backed Cyber Espionage Campaign Hits Middle East Infrastructure with Precision and Persistence
A prolonged and highly covert cyber campaign has been exposed, targeting critical national infrastructure (CNI) in the Middle East. The operation, believed to be orchestrated by a threat group aligned with Iran, reveals a strategic focus on long-term intelligence collection and sustained access to vital systems.
Spanning nearly two years—from May 2023 through February 2025—with signs pointing to an even earlier compromise as far back as May 2021, the operation underscores the increasing technical depth and persistence of state-aligned actors in compromising essential infrastructure.
The initial breach was achieved using compromised VPN credentials. Once inside, the intruders entrenched themselves by deploying a suite of backdoors and web shells across key systems. They methodically expanded their presence, sidestepping network segmentation by leveraging open-source proxy tools to infiltrate deeper network layers—potentially including sensitive operational technology (OT) zones.
Security analysts at Fortinet tracked the progression of this campaign and observed a diverse and evolving toolkit. The attackers combined known public malware with bespoke components, adapting their methods over time to remain undetected and maintain control.
The intrusion unfolded in carefully staged phases. Each wave brought fresh malware strains and infrastructure upgrades, enabling the actors to widen their reach within the affected networks. Of particular concern was the use of three new backdoors—HanifNet, HXLibrary, and NeoExpressRAT—each designed to execute commands, manipulate files, and perform detailed system reconnaissance with minimal detection.
These custom-built implants allowed the operators to sustain deep, covert access across the environment. Even after containment measures were initiated, the adversaries displayed notable resilience—attempting reentry through the exploitation of zero-day vulnerabilities in ZKTeco ZKBioTime software and by launching tailored phishing attacks aimed at reclaiming administrator-level access.
NeoExpressRAT: A Closer Look
At the heart of the toolset was NeoExpressRAT, a highly capable remote access trojan written in Golang. This advanced backdoor featured embedded command-and-control (C2) mechanisms and supported a broad array of functions—from remote command execution to system inventory—making it one of the most potent and persistent threats observed in the campaign.
Timeline of Evolving Toolsets Reveals Adaptive Malware Strategy
(Based on insights from Fortinet research)
Over the course of this extended intrusion, threat actors continuously refined their malware arsenal. Each phase introduced subtle but significant changes to evade detection and increase control, revealing a deliberate, adaptive strategy that evolved alongside defensive responses.
One notable technique used by the attackers involved leveraging Windows’ own scheduling system to ensure malware persistence. Instead of relying on obviously malicious names, the malware disguised itself by adopting file names and task descriptions that mimicked native Windows services—allowing it to operate in plain sight without raising suspicion.
A key weapon in this toolkit was NeoExpressRAT, a stealthy backdoor engineered for longevity and resilience. Communication with its command-and-control (C2) server was encrypted and passed through a custom obfuscation layer, specifically designed to slip past typical traffic inspection tools.
When deployed, NeoExpressRAT quietly builds a concealed directory within the user’s environment to store configuration settings and collected data. It uses a structure like this:
Go
func createHiddenPath() string {
userProfile := os.Getenv(“USERPROFILE”)
hiddenPath := filepath.Join(userProfile, “AppData”, “Local”, “Microsoft”, “Windows”, “SystemConfig”)
os.MkdirAll(hiddenPath, 0700)
return hiddenPath
}
This technique places malicious content in a path indistinguishable from standard Windows components—reducing the chance of discovery during routine scans or manual inspection.
The backdoor itself offers the intruder full control over the system, including data access, remote command execution, and lateral movement—all while maintaining a lightweight presence on disk.
By embedding malicious tools in trusted locations and cloaking network activity with proprietary encoding, the attackers achieved a high level of operational security. These choices illustrate not just technical skill, but a deep understanding of how to exploit trust in familiar system behaviors—making this campaign especially difficult to detect and neutralize in high-risk infrastructure environments.
