'Lemon Sandstorm' Underscores Risks to Middle East Infrastructure

An Iran-backed APT dubbed "Lemon Sandstorm" infiltrated a Middle Eastern critical national infrastructure provider over at least two years using stolen VPN credentials, Exchange web shells, and five custom tools to establish long-term persistence and attempt lateral movement toward operational technology (OT) systems; strong network segmentation prevented OT compromise and little data exfiltration was observed. Fortinet assisted remediation and the report emphasizes hardening measures such as multifactor authentication, rapid patching, network segmentation, and regular incident-response exercises.