Threat Advisories

Top Middle East Cyber Threats – 23 September 2026

By Help AG

Help AG’s Managed Security Services (MSS) team delivers 24x7x365 monitoring across complex enterprise environments, providing continuous visibility into emerging cybersecurity threats across the region.

PAYLOAD Ransomware Deployed Through Active Directory GPOs

A threat actor compromised a manufacturing organisation in the Middle East using a valid domain account to access its FortiGate Secure Sockets Layer Virtual Private Network (SSL VPN). The actor ultimately obtained privileges equivalent to those of a domain administrator.

Rather than deploying ransomware directly across Windows endpoints, the actor created malicious domain-level Group Policy Objects (GPOs), including PAYLOAD.

These GPOs were used to:

Distribute ransom notes.

Alter wallpapers and lock screens.

Disable the local administrator account.

Disable Windows Firewall across domain-joined systems.

The attack caused organisation-wide disruption without encrypting Windows files or deploying endpoint malware. Data was also exfiltrated and later published on the dark web.

A PAYLOAD ransomware sample targeting ESXi was identified on Linux servers. However, the impact on Windows systems relied entirely on trusted Active Directory and GPO mechanisms.

Recommendations

Remove the malicious PAYLOAD and Windows Firewall Off GPOs from Active Directory.

Remove the malicious payload.jpg and hello.txt artefacts from the System Volume (SYSVOL).

Reset the compromised account and review all privileged accounts for unauthorised changes.

Rotate KRBTGT credentials twice if Domain Admin compromise is confirmed.

Force a Group Policy refresh across endpoints after removing the malicious policies.

Restore Windows Firewall and local administrator settings through trusted Group Policy.

Restrict GPO creation and domain-root linking permissions to designated, authorised administrators.

Enable auditing for GPO creation, modification, linking and deletion.

Alert on unauthorised domain-root gPLink modifications and newly created GPOs.

Monitor SYSVOL for unexpected file creation, modification and policy changes.

Enforce phishing-resistant multi-factor authentication (MFA) for FortiGate SSL VPN and other remote-access services.

HEAVYGRAM Campaign Uses Social Engineering to Deploy Backdoor

HEAVYGRAM is a multi-stage Windows surveillance backdoor that has been active since 2023. It is attributed with moderate confidence to the state-linked Handala Hack threat actor.

The malware has targeted journalists, government opponents and other individuals of interest through social engineering delivered via messaging applications.

Initial-stage files have been disguised as legitimate applications, including Telegram, KeePass and Pictory.

Its infection chains use Visual Basic Script (VBS) files, Windows Script Files (WSF), HTML Application (HTA) files, embedded archives and CRUDEEXCLUDE components. These are used to execute PowerShell, evade Microsoft Defender and deploy the persistent HEAVYGRAM implant.

Once installed, HEAVYGRAM uses Telegram bots, users and groups for command-and-control. Its capabilities include arbitrary command and process execution, additional payload delivery, screenshot capture, system and process discovery, Telegram Desktop data theft, file exfiltration and registry-based persistence.

The malware also supports DLL sideloading through legitimate Windows binaries. Related CRUDEEXCLUDE samples establish Defender exclusions before launching HEAVYGRAM.

Recommendations

Monitor Windows endpoints for known HEAVYGRAM and CRUDEEXCLUDE indicators.

Monitor for messaging-based social engineering campaigns delivering executable files, VBS, WSF, HTA, SCR or archive files.

Monitor PowerShell execution initiated by VBS, WSF, HTA and suspicious executables.

Detect PowerShell commands that add Microsoft Defender exclusions.

Monitor for unauthorised modifications to Microsoft Defender exclusion paths.

Monitor Windows autorun registry keys for unauthorised persistence mechanisms.

Monitor for executables masquerading as Telegram, KeePass, Pictory, PowerShell or legitimate Windows utilities.

Detect suspicious DLL sideloading involving bthudtask.exe.

Monitor the creation of suspicious or spoofed Windows directories, including paths containing trailing spaces.

Monitor connections to Telegram application programming interfaces (APIs) from systems that do not normally require Telegram access.

Monitor for unusual automated communication with Telegram bots and groups.

BigDiskBuster Disrupts Microsoft Defender Updates

A newly released proof-of-concept (PoC) called BigDiskBuster demonstrates a denial-of-service technique that can disrupt Microsoft Defender Antivirus updates on Windows systems.

Instead of disabling Microsoft Defender directly, BigDiskBuster fills the device’s available disk space with temporary files while Defender is trying to update. This can prevent security intelligence, engine and platform updates from being installed successfully.

The PoC also restricts access to MRT.exe, which can interfere with the way updates are prepared, installed or rolled back.

As a result, Microsoft Defender may continue to run but without the latest protection updates. This could reduce its ability to detect newly emerging threats.

The technique is still experimental and has not been independently verified across all supported Windows versions. Microsoft Defender update failures alone should therefore not be considered evidence of BigDiskBuster activity.

Recommendations

Monitor for sudden or abnormal depletion of free disk space on Windows endpoints.

Monitor for unusual hidden files created in user temporary directories.

Monitor for suspicious processes allocating large amounts of the remaining disk space.

Monitor for persistent or restrictive file handles opened against MRT.exe.

Monitor Microsoft Defender update failures and repeated installation errors.

Monitor Microsoft Defender Operational logs for missing successful update events, including Event ID 2000.

Alert on repeated Microsoft Defender security intelligence, engine or platform update failures.

Validate Microsoft Defender update errors before treating them as malicious activity.

Preserve process, file and file-handle telemetry when BigDiskBuster-like activity is suspected.

Terminate confirmed processes interfering with Microsoft Defender updates.

Recover disk capacity after identifying suspicious disk-exhaustion activity.

Force Microsoft Defender updates through a trusted update mechanism.

Microsoft Patches Edge Privilege Escalation Vulnerability

Microsoft has released a security update for a High-severity vulnerability affecting Microsoft Edge (Chromium-based).

[High] CVE-2026-88097: A use-after-free vulnerability in Microsoft Edge (Chromium-based) could allow an unauthorised attacker to elevate privileges locally.

Recommendations

Ensure all affected systems are patched and updated.

Cisco Addresses ISE Injection Vulnerability

Cisco has released a security update for a Medium-severity vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).

[Medium] CVE-2026-76451: The vulnerability could allow an authenticated remote attacker to carry out a Structured Query Language (SQL) or Hibernate Query Language (HQL) injection attack.

It is caused by insufficient validation of user-supplied input before it is used to construct database queries.

An attacker could exploit the vulnerability by sending a specially crafted request to an affected device. If successful, they could execute arbitrary SQL or HQL queries against the underlying database, potentially allowing them to view or modify data they are not authorised to access.

Valid administrative credentials are required to exploit the vulnerability.