Iran's APT34 Abuses MS Exchange to Spy on Gulf Gov'ts

Trend Micro and other researchers report a notable rise in espionage by APT34 against Gulf-state government organizations, especially in the UAE. The actor uses web shells to deploy tools (including ngrok) for C2, a new backdoor named StealHook to harvest Exchange and domain credentials and exfiltrate data via mail attachments, and exploits CVE-2024-30088 plus a malicious Windows password filter DLL to obtain elevated and plaintext credentials—facilitating lateral movement and supply-chain follow-on attacks.