'Crafty Camel' APT Targets Aviation, OT With Polygot Files

Executive Summary: Proofpoint observed a highly targeted espionage campaign (Crafty Camel) leveraging business email compromise to deliver novel polyglot files that unpack a Golang backdoor called Sosano to a small set of aviation, satellite communications, and critical transportation organizations in the UAE; Proofpoint links the TTPs to Iranian-aligned threat clusters and highlights the adversary's emphasis on stealth and analysis-evasion.