Emergency Updates for Endpoint Manager Mobile

Ivanti has released security updates for Ivanti Endpoint Manager Mobile (EPMM) addressing five high-severity vulnerabilities, including an actively exploited remote code execution flaw.

The vulnerabilities impact core EPMM functionality and include risks related to authentication bypass, privilege escalation, improper certificate validation, and arbitrary method invocation.

Vulnerability Breakdown

Product & Version Matrix

Affected Product: Ivanti Endpoint Manager Mobile (EPMM)

Affected Versions: Version 12.8.0.0 and prior

Patched Versions

Organizations should immediately upgrade to one of the following fixed releases:

• 12.6.1.1
• 12.7.0.1
• 12.8.0.1

These releases also include cumulative fixes for previous critical flaws (CVE-2026-1281 and CVE-2026-1340).

Recommended Actions

Infrastructure Resilience

Mobile device management platforms are highly sensitive infrastructure components with extensive access to enterprise devices, identities, and policies. Vulnerabilities affecting these systems can rapidly escalate into broader enterprise compromise.

The confirmed active exploitation of CVE-2026-6973 further increases operational urgency for organizations running affected environments. CyberShelter recommends a proactive audit of all MDM configurations following the application of these patches.

Vulnerability in Managed Kubernetes GitOps

A critical vulnerability has been identified in Rancher Fleet, a widely used GitOps solution for managing Kubernetes clusters at scale.

Tracked as CVE-2026-41050, the flaw allows attackers with limited repository access to bypass multi-tenant isolation controls and gain effective cluster-admin privileges across downstream Kubernetes environments.

Improper Impersonation Handling

The vulnerability stems from improper handling of impersonation and access controls within Rancher Fleet's multi-tenant architecture.

Attackers with limited repository permissions may exploit the flaw to:

• Bypass tenant isolation boundaries
• Escalate privileges within managed Kubernetes clusters
• Obtain effective cluster-admin level access

Environment Exposure

Organizations using shared Kubernetes infrastructures, multi-tenant DevOps environments, or centralized GitOps workflows are at elevated risk.

Patched Versions

Recommended Actions

GitOps and Infrastructure Risk

GitOps platforms play a central role in modern Kubernetes operations and often possess broad administrative privileges across environments. Vulnerabilities affecting these systems can rapidly expand into full infrastructure compromise if not addressed promptly.

The ability to escalate from limited repository access to cluster-admin privileges significantly increases the operational risk of this vulnerability. Organizations should apply least-privilege access policies and segment tenant environments where possible.

Recent Security Findings in Widely Used Applications

Recent security findings have identified multiple vulnerabilities in widely used desktop applications, including Notepad++ and Foxit PDF Reader / Foxit PDF Editor.

These vulnerabilities range from denial-of-service (DoS) and information disclosure to potential arbitrary code execution, highlighting the importance of timely patching and secure file handling practices.

Critical Vulnerability in Notepad++

CVE-2026-3008 – Format String Injection in nativeLang.xml

• Severity: Critical (CVSS v4: 10)
• Vulnerability Type: Format String Injection

Description

The vulnerability exists in how Notepad++ processes the nativeLang.xml localization file, specifically the find-result-hits parameter.

When users perform actions such as "Find ALL in Current Document", a specially crafted XML file can inject malicious format string payloads that are processed without proper validation.

Potential Impact

• Application crashes and instability (DoS)
• Exposure of sensitive memory contents
• Leakage of internal application data
• Increased risk of further exploitation

Multiple Vulnerabilities in Foxit PDF Reader and Editor

Multiple vulnerabilities have been identified affecting Foxit PDF Reader (Windows) and Foxit PDF Editor (Windows).

Denial-of-Service Vulnerabilities

Use-After-Free Vulnerabilities (Potential RCE)

Affected Versions

Foxit PDF Reader: Version 2026.1.0.36452 and earlier

Foxit PDF Editor:

• Version 2026.1.0.36452
• Version 2025.3.0.35737 and earlier (2025.x)
• Version 2024.4.1.27687 and earlier (2024.x)
• Version 2023.3.0.23028 and earlier (2023.x)
• Version 14.0.3.335002 and earlier (14.x)
• Version 13.2.3.24041 and earlier

Recommended Actions & Strategic Perspective

Potential Impact

If exploited, these vulnerabilities could result in:

• Application crashes or denial-of-service
• Exposure of sensitive data
• Memory corruption leading to code execution
• Increased attack surface through malicious files

Recommended Actions

Organizations and users should take immediate steps:

Strategic Perspective

These vulnerabilities highlight ongoing risks associated with file parsing and memory management in widely used applications. Attackers frequently exploit such weaknesses using specially crafted files to trigger crashes or gain deeper system access.

Applications that process user-supplied content, such as text editors and PDF tools, remain high-value targets. Timely patching and cautious handling of external files are essential to mitigating these risks. Organizations should prioritize updates and reinforce user awareness to reduce exposure to exploitation attempts targeting commonly used desktop applications.

Active Exploitation of SD-WAN Infrastructure

Multiple high-severity vulnerabilities have been identified in Cisco Catalyst SD-WAN Manager that are currently being actively exploited in the wild. These flaws could allow attackers to gain unauthorized access, overwrite critical system files, and expose sensitive system credentials, potentially leading to a complete compromise of the network management platform.

Technical Analysis of Exploited Flaws

Recommended Secure Versions

Cisco has released updates for all supported branches. Organizations are advised to upgrade based on the following schedule:

Immediate Defensive Measures

Security Vulnerability Summary

Multiple vulnerabilities have been identified affecting a wide range of Cisco enterprise products. These issues include authentication bypass, cross-site scripting (XSS), SQL injection, privilege escalation, and arbitrary file operations. Collectively, these vulnerabilities could impact the confidentiality, integrity, and availability of sensitive systems if left unpatched.

Medium-Severity Findings

Potential Consequences

Successful exploitation of these vulnerabilities could result in unauthorized access, script execution, database manipulation, and theft of sensitive information. Particularly concerning are the file overwrite and privilege escalation flaws which could lead to full system compromise.

• Unauthorized Access: Gaining administrative control without valid credentials.
• Data Exposure: Accessing sensitive files or PII through improper downloads.
• System Integrity: Overwriting critical system files to disrupt operations.

Defensive Mitigations

Vulnerability Landscape Overview

Recent security findings highlight critical and high-risk vulnerabilities affecting both endpoint VPN solutions and industrial simulation software. These issues could enable unauthorized access, data exposure, and privilege escalation, posing significant risks to enterprise environments as well as critical infrastructure systems.

Improper File Access & Credential Exposure

Multiple high-severity vulnerabilities have been identified in the Synology SSL VPN Client, affecting confidentiality and credential security.

Affected Versions & Fixes

• Affected Versions: Prior to 1.4.5-0684
• Fixed Version: 1.4.5-0684 or later
• Impact: Exposure of sensitive configuration, credential data, and increased risk of network interception.

Critical Authorization Bypass

A critical vulnerability in AVEVA Pipeline Simulation allows unauthenticated attackers to bypass authorization controls entirely.

CVE-2026-5387: This vulnerability permits network-accessible, unauthenticated attackers to perform administrative-level actions via exposed APIs. In industrial control systems (ICS), this could lead to manipulation of simulation data and compromise of operational decision-making.

• Affected Versions: 2025 SP1 (build 7.1.9497.6351) and prior.
• Fixed Version: 2025 SP1 P01 (build 7.1.9580.8513) or later.

CyberShelter Best Practices

For Synology VPN Client

For AVEVA Pipeline Simulation

Vulnerability Landscape Overview

CyberShelter Threat Intelligence has identified multiple critical and high-severity vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities impact core components including WebSockets, GraphQL APIs, Terraform state handling, and CSV processing. Successful exploitation could lead to service disruption (DoS), sensitive data exposure, and unauthorized access.

Key Findings and Risks

GitLab has released security updates addressing multiple vulnerabilities that could allow attackers to crash services through malformed requests, access sensitive data, execute malicious scripts, or bypass authorization controls. These issues affect both CE and EE deployments, with some vulnerabilities specific to enterprise features like analytics dashboards and SBOM APIs.

High Severity Vulnerabilities

• CVE-2026-5173 (CVSS: 8.5): Improper access control in WebSocket implementation allows authenticated users to invoke unintended server-side methods, potentially leading to privilege abuse.
• CVE-2026-1092 (CVSS: 7.5): Malformed JSON payloads in Terraform State Lock API can crash services. This is exploitable without authentication.
• CVE-2025-12664 (CVSS: 7.5): Repeated GraphQL queries can overload system resources, leading to performance degradation or service unavailability.

Medium & Low Severity Risks

Denial of Service & Resource Exhaustion

• CVE-2026-1403: CSV import DoS affecting Sidekiq workers.
• CVE-2026-1101: GraphQL SBOM API DoS (EE specific).

Injection & Information Disclosure

• CVE-2026-1516: Code Quality report injection leading to IP leakage (EE).
• CVE-2026-4332: XSS in analytics dashboards (EE).
• CVE-2025-9484: GraphQL email disclosure (EE).
• CVE-2026-2104: CSV export data leakage (CE/EE).

Authorization & Access Control

• CVE-2026-2619: Incorrect authorization in vulnerability API (EE).
• CVE-2026-1752: Improper environment API access control (EE).
• CVE-2026-4916 (Low Severity): Custom Role Permission Escalation leading to elevated privileges.

Vulnerable & Secure Versions

Organizations should upgrade immediately to the latest patched versions to mitigate these risks across their CI/CD and DevOps infrastructure.

Exploitation Methodologies

Behavioral Detection Markers

Network Indicators

Application & System Indicators

Threat Actor Techniques

CyberShelter Best Practices

Intelligence Collection Campaign Overview

CyberShelter Threat Intelligence has identified a coordinated credential harvesting campaign targeting multiple sectors across the UAE, including government entities, telecom providers, financial institutions, and defense organizations. The campaign leverages compromised Microsoft Exchange OWA portals and VPN phishing infrastructure to steal enterprise credentials.

Key Findings and Infrastructure

Investigators identified a sophisticated global infrastructure spanning 112 IP addresses used for automated phishing deployment. A distinctive attacker certificate template was observed across multiple hosts: O=Int, OU=Internal, L=Portland, C=US.

Attack Infrastructure Components

• Exchange Compromise: Four confirmed compromised hosts acting as active OWA credential harvesting systems.
• VPN Phishing Portals: Fake FortiGate VPN portals designed to capture remote access credentials.
• JavaScript Keyloggers: Malicious OWA scripts that capture credentials before authentication completes.
• Hosting: Heavy reliance on Microsoft Azure UAE infrastructure and global VPS environments.

Threat Actor Analysis

Supporting Evidence

• Targeting of national government entities and defense contractors.
• Sophisticated OWA credential harvesting techniques.
• VPN impersonation infrastructure tailored for enterprise targets.
• Long-term intelligence collection focus rather than financial gain.

Operational Tradecraft

Immediate Actions & Hardening

Infrastructure & Behavioral Markers

• Certificate Subject: O=Int, OU=Internal, L=Portland, C=US
• Behavioral: Modified OWA authentication logic or unauthorized JavaScript in login forms.
• Network: Connections to look-alike VPN domains or suspicious Azure hosted infrastructure.
• Persistence: Presence of unauthorized ASPX files in Exchange web directories.

Business and Security Risk Overview

CyberShelter Threat Intelligence has identified multiple security vulnerabilities affecting NVIDIA Triton Inference Server and NVIDIA DALI, both critical components in AI/ML production environments. These vulnerabilities could allow attackers to cause denial-of-service (DoS), information disclosure, or arbitrary code execution (RCE).

Triton Inference Server Vulnerabilities

CVE-2026-24146 Input Validation DoS

Insufficient input validation combined with excessive output handling may allow attackers to crash Triton servers, disrupting AI workloads and production pipelines.

CVE-2026-24173 & CVE-2026-24174 Malformed Request DoS

Attackers could send malformed requests that cause Triton server instability, resulting in server crashes and processing failures.

CVE-2026-24175 Malformed Header DoS

Malformed HTTP headers could trigger denial-of-service conditions and server crashes.

CVE-2026-24147 Information Disclosure

Uploading a specially crafted model configuration could allow attackers to expose sensitive information including model configurations, processing logic, and system metadata.

Arbitrary Code Execution Risk

This represents the highest risk vulnerability in the set due to its potential for full system compromise and infrastructure takeover.

Version Status

Exploitation Workflows

• AI Service Disruption: Attacker sends malformed requests triggering Triton processing flaws, causing server crashes and service unavailability.
• Model Exploitation: Attacker uploads malicious model configurations to trigger information disclosure of sensitive configuration data.
• Code Execution: Attacker delivers malicious serialized data to trigger the DALI deserialization flaw, enabling arbitrary code execution and infrastructure compromise.

Hardening and Patching

SOC Monitoring Focus

• Unexpected server crashes: Monitor for recurring instability in Triton containers.
• Suspicious model uploads: Alert on unauthorized or abnormal model configuration changes.
• Abnormal request patterns: Detect unusually large or malformed HTTP headers and payloads.
• Unauthorized code execution: Monitor for unknown processes spawned within AI server environments.

Authentication Bypass & RCE Chaining

The National Cybersecurity Authority has issued a critical alert regarding multiple vulnerabilities discovered in Progress ShareFile s Storage Zones Controller (SZC). These vulnerabilities allow unauthenticated attackers to achieve Remote Code Execution (RCE) and fully compromise affected systems through a combination of authentication bypass and improper file handling.

CVE Breakdown

Attack Methodology

• Preparation: Attackers exploit weaknesses in redirect validation logic to gain administrative access without credentials.
• Execution: Attacker abuses vulnerable upload functions to deploy ASPX web shells.
• Persistence: Web shells enable arbitrary command execution and lateral movement.

Affected Systems

Immediate Resilience Actions

Detection Indicators (IOCs)

• Suspicious authentication bypass attempts in HTTP logs.
• Unexpected ASPX files in webroot directories.
• Unusual PowerShell or command execution spawned by the web server process.
• Abnormal outbound network connections from the ShareFile server.

Industrial-Scale Cyber Warfare

Since February 28 2026, Iranian cyber operations have transitioned from reactive retaliation into what can now be classified as industrial-scale cyber warfare, combining destructive cyberattacks, supply-chain compromise, infrastructure targeting, and multi-state threat collaboration.

Cyber-Physical & Enterprise Escalation

2. Cyber-Physical Convergence: Cloud Infrastructure Targeting

Iran-linked operations targeted cloud infrastructure facilities (Data Centers, Cloud Regions) in the Middle East, disrupting banking systems, enterprise cloud workloads, financial platforms, and ride-hailing applications. This marks one of the first known examples of cloud infrastructure becoming a geopolitical battlefield.

Strategic Shift: Attack focus expanded from Networks, VPNs, and Industrial systems to include Cloud regions, Data centers, SaaS ecosystems, and DevOps pipelines. This signals a transition toward digital supply chain warfare.

3. Expansion of Iranian Threat Actor Ecosystem

Iranian cyber operations expanded from 6 major groups to more than 10 active threat actors, specifically targeting telecom, aerospace, and maritime sectors. Key actors include:

• Void Manticore (Handala)
• MuddyWater
• Cotton Sandstorm / Charming Kitten
• CyberAv3ngers / ShroudedSnooper
• Dust Specter

4. Supply Chain Attacks becoming a Primary Weapon

Attackers targeted developer ecosystems (npm, Docker, GitHub tokens, CI/CD, AI tooling). A single campaign cascaded across multiple platforms within days, showing the growing risk of software trust exploitation.

5. Surveillance Infrastructure Exploitation

Increased exploitation of Hikvision and Dahua cameras for intelligence gathering, military targeting, and physical surveillance. This marks a dangerous evolution toward cyber-enabled kinetic targeting.

Major Attack Trends Identified

Next 30–180 Days

Strategic Resilience Actions

Cyber Warfare Reality Check

Final Conclusion: The cyber escalation observed since February 28 2026 demonstrates a new cyber warfare model defined by industrialized operations, infrastructure targeting, identity compromise, and supply chain warfare. Geo-political risk must now be treated as a continuous operational threat rather than a theoretical scenario.

Regional Threat Landscape

CyberShelter Threat Intelligence has identified an escalation in cyber threat activity across the Middle East region during Q1 2026 involving multiple Iranian-linked Advanced Persistent Threat (APT) groups. The campaign shows increased targeting of government, telecom, defense, financial, and cloud infrastructure sectors.

Threat intelligence indicates a coordinated increase in cyber operations linked to geopolitical tensions, including ransomware operations, Microsoft 365 password spraying campaigns, infrastructure breaches, and AI-assisted cyber operations.

Key Identified Groups

Handala / Void Manticore

Observed Capabilities: Data breach operations, infrastructure targeting, domain reconstitution after seizures, AI-assisted PowerShell obfuscation, and mobile device management abuse. Threat intelligence also observed Microsoft Intune abuse for mass device wipe operations.

MuddyWater (Boggy Serpens)

Malware Observed: CHAR (Rust-based), BlackBeard backdoor, LampoRAT (Telegram RAT), NUSO custom HTTP malware, UDPGangster macro malware, and RustyWater RAT. These indicates a diverse toolkit for persistence and C2 operations.

Other Active Threat Groups

• APT34 (OilRig): Linked to credential harvesting and infrastructure targeting.
• Helix Kitten: Cyber espionage operations targeting aerospace and defense.
• 313 Team / Dienet: Infrastructure targeting and data exfiltration.
• Iran-nexus M365 spray cluster: Large-scale credential harvesting operations.

March 2026 Key Events

Dark Web Exposure Activity

Threat intelligence observed data exposure claims involving defense and aerospace, law enforcement, intelligence organizations, government ministries, telecom providers, and financial institutions.

IOC Database

Handala Infrastructure

Primary Domain: handala-hack[.]ps

Seized Domains: handala-hack[.]to, justicehomeland[.]org, karmabelow80[.]org, handala-redwanted[.]to

C2 IP: 107.189.19[.]52

MuddyWater Infrastructure

C2: 162.0.230[.]185 (SSH on port 22)

Phishing: 157.20.182[.]75:5000

Malware Artifacts

Active CVE Targets

MITRE ATT&CK Mapping

• T1486: Data Encrypted for Impact (Ransomware)
• T1110.003: Password Spraying (Microsoft 365)
• T1059.001: PowerShell Execution (Obfuscated)
• T1071.001: Web Protocol C2 (HTTP Malware)

Threat Severity Matrix

Security Actions & Detection

Detection Priorities

Identity: Spikes in failed logins, impossible travel, and MFA bypass attempts. Endpoint: Custom RAT indicators and nvdaHelper loader execution. Network: Outbound C2 connections and DNS anomalies.

Vulnerability Details

CyberShelter Threat Intelligence has identified a critical vulnerability affecting Cisco Smart Software Manager On-Prem (SSM On-Prem) that could allow unauthenticated remote attackers to execute arbitrary commands with root privileges.

Tracked as CVE-2026-20160, the vulnerability carries a CVSS score of 9.8 (Critical) and may allow complete system compromise if exploited.

Technical Details

Description

The vulnerability occurs due to exposure of an internal service that should not be externally accessible. Attackers may interact with a vulnerable API endpoint to execute arbitrary commands.

Root Cause

The issue is caused by:

• Improper exposure of internal services
• Insufficient access restrictions
• API endpoint exposure
• Improper security boundary enforcement

Attack Scenario Analysis

Successful exploitation could allow attackers to fully compromise the system. Because SSM manages licensing and device trust relationships, compromise could have wider enterprise implications.

Risk Impact Analysis

Business Risks: Licensing infrastructure compromise, unauthorized software activation, service disruptions, infrastructure instability, and security compliance issues.

Security Risks: Attackers could potentially gain privileged system access, deploy backdoors, modify device trust configurations, access internal infrastructure, and establish long-term persistence.

Affected Products & Defense

Affected Products

Not Vulnerable

Versions earlier than 9-202502 are reported as not vulnerable.

Fixed Versions

Immediate Defensive Actions

• Patch Management: Upgrade to Cisco SSM version 9-202601 and apply Cisco security advisories.
• Exposure Reduction: Restrict SSM access to trusted networks, remove internet exposure, use VPN access, and apply Zero Trust policies.
• Access Controls: Enforce MFA for admin access, apply role-based access controls, and enforce least privilege.
• Monitoring Controls: Monitor API requests, track CLI execution activity, monitor administrative logs, and detect suspicious commands.

Vulnerability Overview

CyberShelter Threat Intelligence has identified a critical zero-click vulnerability affecting the Telegram messaging platform, disclosed through the Trend Micro Zero Day Initiative. The vulnerability, tracked as ZDI-CAN-30207, carries a CVSS score of 9.8 (Critical) and could allow remote attackers to fully compromise devices without any user interaction.

Risk Explanation

Successful exploitation could allow attackers to execute malicious code remotely, access sensitive communications, conduct surveillance operations, steal confidential data, compromise enterprise devices, and disrupt system availability.

Zero-Click Exploitation

Attackers can compromise devices without clicking links, opening attachments, accepting messages, or user awareness. This significantly increases the success probability of targeted attacks.

No Authentication Required

Attackers do not require Telegram accounts, prior access, or trusted relationships. Use interaction is nonexistent, and exploitation complexity is low, increasing the likelihood of widespread use.

Potential Risks

Suspicious Indicators

• Unexpected Telegram crashes
• Device overheating after message receipt
• Unusual background processes
• Suspicious network traffic
• Unauthorized session logins

Immediate Actions

Threat Overview

Campaign Analysis

CyberShelter Threat Intelligence has identified renewed activity from the PAY2KEY ransomware group demonstrating enhanced anti-forensic techniques, credential harvesting, and rapid encryption capabilities.

The campaign shows operational maturity with stealth access, delayed execution, and rapid encryption designed to defeat traditional incident response timelines.

Threat Scorecard

Kill Chain Details

Initial Access

Attackers gain access through compromised admin accounts, initial access broker markets, remote access exposure, or weak privileged account controls.

Persistence (TeamViewer Abuse)

Attackers use legitimate remote management software (TeamViewer) already installed in the environment to avoid malware detection triggers.

Credential Access

Observed tools: Mimikatz, LaZagne, ExtPassword. Goal: Privilege escalation and lateral movement preparation.

Discovery Activity

Network discovery using: Advanced IP Scanner, NetScan, Active Directory tools. Goal: Identify high-value systems before encryption.

Execution Phase

• PowerShell execution
• Backup discovery
• Hypervisor targeting
• File indexing prior to encryption

Encryption Phase

Evasion Capabilities

PAY2KEY demonstrates strong forensic evasion through Windows event log wiping, backup catalog deletion, Defender disablement, and more.

Observed Techniques

• ? Windows event log wiping
• ? Backup catalog deletion
• ? Defender disablement
• ? Recovery environment disabling
• ? Tool artifact deletion
• ? BitLocker suspension

Key Anti-Forensic Commands

Attackers wipe logs as the final action to remove investigation evidence.

IOC Intelligence

File Hash Indicators (SHA256)

Behavioral Detection IOCs

SOC teams should hunt for:

• Suspicious Process Behavior: TeamViewer spawning cmd.exe/PowerShell, wsc_proxy.exe, browser.exe from temp, abc.exe.
• Suspicious Security Actions: BitLocker suspension, backup deletion, log clearing, Defender tampering.
• Virtual Infrastructure Targeting: Hyper-V shutdown, VHD dismount.

Tool Execution Indicators

• Credential Theft: Mimikatz, LaZagne, ExtPassword
• Network Discovery: Advanced IP Scanner, NetScan
• Administrative Abuse: wbadmin.exe, bcdedit.exe, dsa.msc

SIEM & Hunting Opportunities

Suspicious Parent Child Processes

Ransomware Behavior Alerts

File Indicators

Mitigation Strategy

Risk Assessment

Critical Vulnerabilities in Cisco Products

Cisco has released multiple security advisories addressing several high-severity vulnerabilities and one critical vulnerability affecting widely deployed networking and security solutions including Cisco IOS, IOS XE, ASA, Secure Firewall Threat Defense (FTD), and Firewall Management Center (FMC).

If successfully exploited, these vulnerabilities could allow attackers to execute remote code, cause denial-of-service (DoS) conditions, bypass security protections, or disrupt enterprise network operations.

Potential Impact

The vulnerabilities identified by Cisco include:

• Remote Code Execution (RCE)
• Multiple Denial-of-Service (DoS) vulnerabilities
• Resource exhaustion issues
• Memory leaks
• Secure boot bypass risks

Vulnerability Details

Critical Vulnerability

Remote Code Execution in Cisco Firewall Management Center

• CVE: CVE-2026-20131
• Affected Product: Cisco Secure Firewall Management Center (FMC)
• CVSS Score: 10.0 (Critical)
• Weakness: CWE-502 (Deserialization of Untrusted Data)
• Advisory ID: cisco-sa-fmc-rce-NKhnULJh

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on affected systems. Due to its critical severity, organizations should prioritize patching immediately.

High Severity Vulnerabilities

IKEv2 Denial-of-Service Vulnerability

• CVE: CVE-2026-20012
• Affected Products: Cisco IOS, IOS XE, ASA, Secure Firewall FTD
• CVSS Score: 8.6
• Weakness: CWE-401 (Memory Leak)
• Advisory ID: cisco-sa-asa-ftd-ios-dos-kPEpQGGK

This vulnerability could allow attackers to cause memory exhaustion resulting in device instability or service outages.

DHCP Snooping DoS Vulnerability

• CVE: CVE-2026-20084
• Affected Products: Cisco IOS XE (Catalyst 9000 Series)
• CVSS Score: 8.6
• Weakness: CWE-400 (Resource Consumption)
• Advisory ID: cisco-sa-bootp-WuBhNBxA

Successful exploitation may allow attackers to cause network disruption by exhausting system resources.

HTTP Server DoS Vulnerability

• CVE: CVE-2026-20125
• Affected Products: Cisco IOS / IOS XE Release 3E
• CVSS Score: 7.7
• Advisory ID: cisco-sa-ios-http-dos-sbv8XRpL

This vulnerability could allow attackers to send crafted HTTP requests causing denial-of-service conditions.

TLS Memory Exhaustion Vulnerability

• CVE: CVE-2026-20004
• Affected Products: Cisco IOS XE
• CVSS Score: 7.4
• Weakness: CWE-771 (Missing Resource Release)
• Advisory ID: cisco-sa-iosxe-tls-dos-TVgLDEZL

Attackers may exploit this vulnerability to exhaust memory resources and disrupt secure communications.

CAPWAP DoS Vulnerability (Wireless Controllers)

• CVE: CVE-2026-20086
• Affected Products: Catalyst CW9800 Wireless Controllers
• CVSS Score: 8.6
• Advisory ID: cisco-sa-wlc-dos-hnX5KGOm

This issue could allow attackers to disrupt wireless controller operations leading to network service interruptions.

Medium Severity Vulnerability

Secure Boot Bypass Vulnerability

• CVE: CVE-2026-20104
• Affected Products: Cisco Catalyst and Rugged Series Switches
• CVSS Score: 6.1
• Weakness: CWE-124
• Advisory ID: cisco-sa-xe-secureboot-bypass-B6uYxYSZ

This vulnerability could allow an attacker with physical access to bypass secure boot protections.

CyberShelter Recommendations

Successful exploitation of these vulnerabilities could result in network outages, device instability, security control bypass, remote compromise, and enterprise network exposure. CyberShelter recommends organizations take the following immediate actions:

Critical Cross-Platform vulnerabilities

Apple has released important security updates across its entire product ecosystem to address multiple vulnerabilities affecting iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari. These vulnerabilities range from information disclosure and privacy issues to denial-of-service (DoS), kernel memory corruption, sandbox escape, and critical WebKit flaws that could allow web-based attacks.

Security researchers warn that successful exploitation could allow attackers to compromise devices through malicious applications, specially crafted web content, or privileged network access.

Potential Impact

The newly patched vulnerabilities could allow attackers to:

• Access sensitive user information
• Cause application or system crashes
• Bypass security protections
• Execute web-based attacks
• Perform sandbox escapes
• Conduct denial-of-service attacks
• Expose privacy-related data

Key Vulnerability Highlights

1. Network & Account Security Issues

• CVE-2026-28865 (802.1X): Network traffic interception from a privileged network position.
• CVE-2026-28877 (Accounts): Unauthorized access to sensitive user data.
• CVE-2026-28866 (Clipboard): Sensitive data exposure vulnerability.

2. Biometric & Device Protection Risks

• CVE-2026-28895 (App Protection): Biometric protection bypass using device passcode (requires physical access).

3. Audio & Media Processing Vulnerabilities

• CVE-2026-28879 (Audio): Use-after-free vulnerability causing app crashes via malicious web content.
• CVE-2026-28822 (Audio): Type confusion vulnerability causing unexpected termination.
• CVE-2026-20690 (CoreMedia): Out-of-bounds memory access.

4. Baseband & Telephony Risks

• CVE-2026-28874 (Baseband): Remote crash vulnerability.
• CVE-2026-28875 (Baseband): Buffer overflow leading to denial-of-service.
• CVE-2026-28858 (Telephony): Buffer overflow leading to kernel corruption.

5. Kernel Vulnerabilities (High Severity)

Multiple high-risk kernel vulnerabilities were patched:

• CVE-2026-28868: Kernel memory disclosure.
• CVE-2026-28867: Leakage of sensitive kernel state.
• CVE-2026-20698: Kernel memory corruption.
• CVE-2026-20687: Use-after-free enabling kernel memory modification.

6. Privilege Escalation & Sandbox Issues

• CVE-2026-20688 (Printing): Sandbox escape vulnerability.
• CVE-2026-28864 (Security): Unauthorized Keychain access.
• CVE-2026-28882 (libxpc): Application enumeration issue.

7. Privacy & Local Exposure Risks

• CVE-2026-28856 (Siri): Sensitive data exposure on locked devices.
• CVE-2026-20692 (Mail): Privacy protection bypass allowing IP leakage.
• CVE-2026-28870 (GeoServices): Information disclosure issue.

8. WebKit Vulnerabilities (Critical Risk)

Several critical WebKit vulnerabilities were addressed that could allow attacks through malicious websites:

• CVE-2026-20665: Content Security Policy bypass.
• CVE-2026-20643: Same Origin Policy bypass.
• CVE-2026-28871: Cross-site scripting (XSS).
• CVE-2026-28859: Sandbox escape via malicious web content.
• CVE-2026-28857: Memory corruption vulnerability.
• CVE-2026-20691: User fingerprinting through crafted webpages.

Supported Platforms and Updates

Apple released updates for the following platforms:

CyberShelter Security Recommendations

CyberShelter strongly recommends organizations and individual users to take the following actions immediately:

Additionally, continue to use strong device passcodes and biometric protection, install applications only from trusted sources, and monitor enterprise devices for unusual behavior.

Critical Operational Risk

CyberShelter Threat Intelligence is monitoring a critical remote code execution vulnerability affecting the GNU InetUtils Telnet daemon (telnetd) that allows unauthenticated attackers to execute arbitrary code remotely.

The vulnerability (CVE-2026-32746) is caused by improper bounds checking in the TELNET protocol negotiation process and can be exploited without authentication or user interaction.

Due to the widespread presence of legacy Telnet services in enterprise infrastructure, embedded systems, and industrial environments, CyberShelter assesses this vulnerability as a critical operational risk, especially where Telnet remains externally accessible.

Technical Summary

Technical Description

The vulnerability exists due to improper bounds checking in the handling of the LINEMODE Set Local Characters (SLC) option within the TELNET protocol. Attackers can exploit this flaw by sending specially crafted TELNET negotiation messages during the initial connection phase.

Exploitation Flow

Vulnerable Software & Systems

Potentially Impacted Systems

Immediate Response Plan

Widespread Enterprise Risk

CyberShelter Threat Intelligence is tracking multiple high-severity vulnerabilities affecting several Atlassian enterprise products including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, and Fisheye/Crucible.

These vulnerabilities may allow attackers to conduct Remote Code Execution (RCE), Path traversal attacks, File inclusion exploitation, Cross-Site Scripting (XSS), Denial-of-Service (DoS), and Command injection attacks.

Successful exploitation may lead to service disruption, unauthorized access, data exposure, or complete system compromise. CyberShelter recommends immediate patching of affected systems to reduce exposure.

Summary of Identified Security Issues

Bamboo Data Center & Server

Risk Description: These vulnerabilities could allow attackers to execute malicious code remotely, exploit Apache Struts weaknesses, disrupt build pipelines, and impact CI/CD operations.

Bitbucket Data Center & Server

Risk Description: Attackers may exploit dependency vulnerabilities to cause application crashes, disrupt repository access, and affect development operations.

Confluence Data Center & Server

Risk Description: This vulnerability may allow attackers to execute system commands, access sensitive data, and compromise Confluence servers.

Crowd Data Center & Server

Risk Description: Potential impacts include credential theft, session hijacking, and identity management compromise.

Jira Software & Service Management

Risk Description: Attackers could exploit these to access restricted files, execute unauthorized code, disrupt services, and compromise development data or support platforms.

Recommended Secure Versions

Potential Attack Patterns

Detection Indicators

CyberShelter Summary Recommendations

CyberShelter continues monitoring exploitation trends associated with these vulnerabilities. Organizations should prioritize patching and monitoring to reduce the risk of exploitation.

Critical RCE Tracking

CyberShelter Threat Intelligence is tracking a critical remote code execution vulnerability affecting Microsoft SharePoint Server that is currently being actively exploited in the wild.

The vulnerability, tracked as CVE-2026-20963, stems from insecure deserialization of untrusted data and allows unauthenticated attackers to execute arbitrary code remotely over the network. Successful exploitation could allow attackers to gain full access to sensitive enterprise data, establish persistence, and pivot across internal environments.

Technical Summary

The vulnerability exists due to improper handling of serialized data within SharePoint services. An attacker can exploit this flaw by sending specially crafted requests containing malicious serialized payloads. Because exploitation occurs prior to authentication, attackers can trigger the vulnerability without valid credentials.

Potential Attack Flow

Vulnerable & Fixed Versions

Microsoft has released security updates addressing this vulnerability. Organizations should validate installed versions immediately.

Exposure Risk Levels

Indicators of Possible Exploitation

Security teams should monitor for behavioral indicators such as unexpected SharePoint process execution, suspicious IIS logs, new service accounts, unauthorized scheduled tasks, and unexpected PowerShell activity.

Immediate Remediation

Strategic Assessment

Threat Level: CRITICAL

CyberShelter assesses this vulnerability as an urgent remediation priority. The active exploitation of CVE-2026-20963 highlights the continued importance of rapid patch management and proactive infrastructure monitoring.

Patching Priority Recommended

CyberShelter Threat Intelligence is monitoring multiple high-severity vulnerabilities recently disclosed affecting widely used enterprise and endpoint technologies including Jenkins, Google ChromeOS, and Apple WebKit platforms.

These vulnerabilities could allow attackers to perform remote code execution (RCE), memory corruption attacks, DNS rebinding, and cross-origin policy bypass. Organizations using affected systems should prioritize patching immediately as exploitation of these flaws could lead to system compromise and data exposure.

Critical Security Issues Identified

Jenkins Core and LoadNinja Plugin

Jenkins has released patches addressing multiple vulnerabilities affecting Jenkins Core and LoadNinja plugin environments. These issues could allow attackers to execute malicious code or expose sensitive credentials.

Technical Risk Analysis

Affected Versions

• Jenkins Weekly: Up to 2.554 (Secure: 2.555)
• Jenkins LTS: Up to 2.541.2 (Secure: 2.541.3)
• LoadNinja Plugin: Up to 2.1 (Secure: 2.2)

Google ChromeOS Graphics and JS Engines

Multiple ChromeOS vulnerabilities affecting core browser components including Skia and the V8 JavaScript engine. Successful exploitation could allow attackers to execute arbitrary code or escape the sandbox.

Fixed Version: ChromeOS LTS 144.0.7559.246 (Platform 16503.78.0)

Apple WebKit Cross-Origin Bypass (CVE-2026-20643)

A high-severity WebKit vulnerability (CVSS 8.8) affecting Apple devices allowing malicious websites to bypass browser security protections via the Navigation API.

Affected and Fixed Versions

Affected: iOS/iPadOS/macOS 26.3.1 and 26.3.2. Secure versions end with (a), such as 26.3.1 (a).

CyberShelter Risk Priority

Immediate Defensive Actions

CyberShelter recommends the following immediate actions across the infrastructure:

Recommended Detection Controls

CyberShelter Recommendations Summary

Incident Response Support

For organizations requiring immediate assistance, CyberShelter NSOC provides comprehensive support services:

• 24/7 Threat Monitoring: Continuous oversight of infrastructure.
• Vulnerability Risk Assessment: Deep-dive analysis of organizational exposure.
• Incident Response: Rapid containment and remediation services.
• Threat Hunting Services: Proactive identification of hidden compromises.

Immediate Security Attention Required

CyberShelter Threat Intelligence has identified two critical security developments that require immediate attention from security teams and infrastructure administrators.

• A critical unauthenticated Remote Code Execution (RCE) vulnerability affecting GNU InetUtils Telnetd (CVE-2026-32746)
• Active exploitation of a Cisco Secure Firewall Management Center zero-day (CVE-2026-20131) by the Interlock ransomware group

Both vulnerabilities allow attackers to gain root-level access and could result in full infrastructure compromise if left unmitigated. CyberShelter assesses organizations running exposed Telnet services or Cisco FMC infrastructure as HIGH RISK until remediation actions are completed.

Critical Vulnerabilities Identified

Critical Telnetd Vulnerability (CVE-2026-32746)

Technical Overview

A critical buffer overflow vulnerability has been discovered in the GNU InetUtils Telnet daemon affecting all versions up to version 2.7. The vulnerability exists due to an out-of-bounds memory write in the LINEMODE SLC handler. This flaw occurs during Telnet option negotiation before authentication.

Attack Mechanism

The vulnerability can be exploited without user interaction:

• Attacker connects to Telnet port 23
• Sends specially crafted SLC negotiation packets
• Memory corruption occurs
• Arbitrary memory writes become possible
• Remote code execution achieved

Potential Impact

• Install persistent backdoors
• Steal sensitive data
• Move laterally across networks
• Deploy ransomware
• Establish command and control access
• Pivot deeper into infrastructure

Active Cisco FMC Zero-Day Exploitation (CVE-2026-20131)

Amazon Threat Intelligence has identified active exploitation of Cisco FMC software by the Interlock ransomware group. This vulnerability involves insecure deserialization of Java byte streams.

Attack Timeline

Attackers had a significant head start before public disclosure.

Interlock Ransomware Attack Chain

CyberShelter analysis shows the attack follows a multi-stage intrusion model:

Tools Observed in the Campaign

Attackers deployed PowerShell scripts to gather OS details, hardware info, installed software, running services, network connections, browser artifacts, RDP logs, and user files.

Custom Remote Access Tools (RAT)

• Interactive shell: Command execution
• File transfer: Data theft
• SOCKS5 proxy: Network pivoting
• Self update: Persistence
• Self delete: Anti-forensics

Infrastructure Obfuscation & Defense Evasion

Attackers used Linux proxy scripts to deploy HAProxy, configure reverse proxy, launder traffic origin, and hide attacker IP. Observed evasion techniques include log deletion cron jobs, shell history removal, memory resident web shells, encrypted command execution, and network beacon validation.

Additional Tools Observed

Indicators of Compromise & Detection Controls

Behavioral Indicators

• Unexpected Cisco FMC access logs
• Unknown HTTP PUT requests
• Unknown ELF downloads
• ScreenConnect installations
• New admin accounts
• Log deletion activity

Network Indicators

• Suspicious outbound HTTP callbacks
• Unknown proxy servers
• Reverse proxy behavior
• Beacon traffic patterns

SOC Detection Priorities

Emerging Ransomware Trends

Google research indicates ransomware groups are evolving tactics:

Immediate Defensive Actions

Priority Actions (Immediate)

CyberShelter recommends the following immediate actions:

• Telnet Security: Disable Telnet if not required, block port 23 externally, restrict internal access, run without root privileges, segment legacy systems.
• Cisco FMC Protection: Apply patches immediately, audit firewall logs, check for compromise, review admin access, validate configurations.
• Infrastructure Monitoring: Review ScreenConnect deployments, check for unauthorized tools, monitor proxy deployments, review remote access tools, audit privileged activity.

Strategic Security Recommendations

• Defense-in-depth architecture
• Zero trust access
• Continuous monitoring
• Threat intelligence ingestion
• Attack surface reduction

Organizations must assume exploitation attempts are ongoing and act immediately to reduce exposure. CyberShelter continues to actively monitor exploitation trends related to these vulnerabilities.

CyberShelter Threat Intelligence Advisory

CyberShelter Threat Intelligence has observed an increase in destructive cyberattacks involving wiper malware, a class of malware designed to permanently destroy data and disrupt business operations. Unlike ransomware, wipers focus on irreversible damage rather than financial gain.

Recent threat actor campaigns show increasing use of supply chain compromise, credential abuse, living-off-the-land techniques, and backup destruction tactics. Organizations must prioritize cyber resilience and rapid recovery capabilities alongside prevention.

What is Wiper Malware

Wiper malware is a destructive cyber weapon used to delete critical files, corrupt operating systems, destroy Master Boot Records (MBR), delete shadow copies and backups, and disable security tools. Impact often includes complete operational shutdown, massive data loss, significant incident recovery costs, and reputational damage.

Wiper Attack Chain

Indicators of Compromise (IOCs)

Behavioral Indicators

• Unauthorized disk access activity
• Sudden admin privilege escalation
• Rapid SMB lateral movement
• Security agent termination
• Suspicious scheduled tasks

System Indicators

• Unexpected reboots and boot failures
• Large file deletion spikes
• Backup system access anomalies

CyberShelter Recommendations

CyberShelter Protection Approach

Destructive attacks such as wiper malware are increasing and organizations must shift from prevention-only strategies to resilience-focused security models combining detection, response, and recovery readiness.

CyberShelter Threat Intelligence Advisory

CyberShelter's Threat Intelligence team has recently identified a set of suspicious Indicators of Compromise (IOCs) associated with potentially malicious infrastructure hosted on cloud platforms. The activity suggests possible malware staging, payload delivery, or command-and-control (C2) preparation leveraging trusted cloud services to evade traditional security controls.

During ongoing threat monitoring activities, suspicious domains and URLs were identified within Microsoft Azure environments. Attackers increasingly abuse reputable cloud providers to blend malicious traffic with legitimate enterprise traffic.

Indicators of Compromise (IOCs)

Malicious Domains

Malicious URLs

File Hashes (SHA256)

MD5 Hashes: 3ba1d4b92b0392ba2018d1d73cb2bc26, 5bd441cb2d1676498506bf006c7942de, 5b432e0db260b6cddf026013353ea21a, 64f5611cc62e65748d140e6f288ce1ea

Technical Assessment

Based on initial analysis, the infrastructure shows characteristics commonly associated with malware delivery, living-off-trusted-cloud techniques, and data exfiltration (upload path observed).

Recommended Mitigation Actions

CyberShelter Protection Approach

This investigation remains ongoing. Organizations should treat these indicators as high-confidence suspicious infrastructure until proven otherwise and take proactive preventive action.

Group Evolution Timeline

Void Manticore (Handala) represents one of the most dangerous active Iran-linked destructive cyber actors currently targeting the UAE. Their ability to combine wiper attacks, influence operations, and infrastructure disruption makes them a significant strategic threat.

Major Destructive Operation

The Stryker Global Wiper Attack demonstrates advanced destructive capability and the use of enterprise management tools as attack vectors.

Technical Attack Methodology

Initial Access Techniques

Observed behaviors: Mass VPN authentication attempts, MSP compromise attempts, security vendor impersonation, and wiper delivery via phishing.

Execution and Evasion

2026 Developments: AI-assisted PowerShell wipers, GPO distribution of destructive payloads, and Windows Defender disabling prior to attacks.

Wiper Malware Architecture

During destructive operations the actor deploys multiple wiping techniques simultaneously.

Indicators of Compromise (IOCs)

Behavioural Indicators: Monitor for VPN login failures, ADRecon execution, GPO script deployment, LSASS dumping, and Defender disabling.

UAE Sector Risk Assessment

Defensive Recommendations

Escalation to Destructive Operations

CyberShelter Threat Intelligence has observed a significant escalation in hacktivist cyber activity across the Middle East between March 7 and March 12 2026. Threat actor activity evolved rapidly from disruptive operations such as Distributed Denial-of-Service (DDoS) attacks and website defacements into more serious incidents including destructive attacks, data breaches, and supply-chain disruption campaigns.

A key development during this period was the Stryker Corporation incident, which demonstrated a new willingness among Iran-aligned actors to conduct large-scale destructive attacks against global commercial supply chains.

Major Observations

The timeline indicates attackers are progressing from visibility-focused attacks to operations intended to cause operational damage.

Major Hacktivist Activity ( 7 to 12 March 2026 )

These events demonstrate a widening cyber conflict impacting multiple regions simultaneously.

Stryker Supply Chain Attack

The most significant event during this reporting period was the destructive attack targeting Stryker Corporation. This attack demonstrates how compromise of device management infrastructure can produce global operational disruption.

Key Threat Actors

These groups represent a mix of ideological hacktivists and criminal operators.

Gulf State Targeting Trends

Energy and government sectors remain the most targeted in the Gulf region.

Breaches and Extortion Campaigns

Hacktivists increasingly use data leaks to amplify psychological pressure. These incidents illustrate how data exposure is used to amplify geopolitical messaging.

Hacktivist Collaboration Trends

CyberShelter identified growing coordination among threat groups, demonstrating a more organized hacktivist ecosystem than previously observed.

Supply Chain Risk Expansion

Threat actors are increasingly targeting supply chains to maximize disruption. Supply chain attacks offer attackers greater geopolitical impact than single-organization attacks.

CyberShelter Threat Intelligence Assessment

CyberShelter assesses the current hacktivist environment as: Ideologically driven + geopolitically motivated + operationally evolving.

• Expansion beyond regional targets
• Increasing destructive capability
• Botnet-driven persistent campaigns
• Greater coordination between groups
• Increased targeting of supply chains

Hacktivists are evolving toward hybrid operations combining propaganda, disruption, and financial crime. CyberShelter expects continued hacktivist activity driven by geopolitical tensions, with organizations needing to prepare for prolonged cyber pressure rather than isolated incidents.

IMMEDIATE DEFENSIVE MEASURES

INFRASTRUCTURE PROTECTION & DETECTION

Organizations should strengthen resilience through network segmentation to reduce lateral movement, OT isolation to protect industrial systems, RBAC enforcement to protect admin systems, and active cloud monitoring to detect compromise.

Detection Priorities: Monitor for MDM administrative changes, DDoS traffic spikes, suspicious data transfers, ransomware staging, and privilege escalation attempts.

Current Threat Posture

Targeting Logic

Understanding Iran's targeting logic is essential for UAE organisations to accurately assess their own risk profile.

Actors Currently Targeting UAE

Iran's offensive cyber capability is distributed across two primary state bodies and an extended ecosystem of proxy hacktivist groups. Understanding this structure is critical because the two state bodies have different mandates, TTPs, and escalation patterns.

Active Wipers in Current Conflict

The following wiper and destructive malware families are confirmed active in the current Iran conflict, deployed by groups that have either directly targeted UAE or have UAE within their stated or demonstrated targeting scope.

Live Campaign Analysis

CONFIRMED UAE TARGETING: Operation Olalampo is an active MuddyWater campaign that has confirmed UAE organisations among its victims. Exposed C2 infrastructure analysis by the Ctrl-Alt-Intel collective identified UAE companies in victim telemetry alongside Israeli, Jordanian, Egyptian, and US entities.

Operation Olalampo represents a significant evolution in MuddyWater's technical capabilities, first observed 26 January 2026 and accelerating post-28 February conflict escalation.

Attack Chain:

New Malware Families - Operation Olalampo:

Ingest Priority Intelligence

INGEST PRIORITY: All IOCs below are from the current 2026 conflict and directly-linked 2025-2026 campaigns. Ingest immediately into SIEM, EDR, firewall, DNS blocklists, and proxy policies. Hash-based IOCs should be supplemented with behavioural detections - Iran-linked actors regularly recompile payloads.

6.1 Operation Olalampo / MuddyWater - C2 Infrastructure

6.2 MuddyWater Malware Hashes (Operation Olalampo / Adjacent Campaigns)

6.3 Actively Exploited CVEs - Iran-Linked Actors (UAE/Gulf Targeting)

PATCH IMMEDIATELY: These CVEs are being actively weaponised by Agrius, Handala/Void Manticore, and Iran-nexus actors against targets in UAE, Israel, and Gulf states RIGHT NOW. Scan for and patch these within 24-48 hours.

6.4 File / Execution Artifacts (Current Campaign TTPs)

6.5 Microsoft Intune Abuse IOCs (Void Manticore / Handala - Stryker Pattern)

UAE SIEM PRIORITY: Any UAE organisation using Microsoft Intune for MDM should treat the following as critical alerting conditions immediately. This is the exact attack chain used to wipe Stryker's global infrastructure on 11 March 2026.

Active Wiper TTPs (UAE Context)

TTPs consolidated from confirmed 2025-2026 Iranian wiper and destructive malware campaigns targeting UAE and Gulf states.