Threat Advisories

Top Middle East Cyber Threats – 04 November 2026

By Help AG

Help AG’s Managed Security Services (MSS) team delivers round-the-clock security monitoring across complex enterprise environments, combining continuous threat visibility with deep regional expertise to help organisations stay ahead of evolving cyber threats.

DarkBlinders Cyberespionage Campaign Targets the Middle East

Researchers have uncovered an active cyberespionage campaign attributed to DarkBlinders, targeting individuals and government environments across the Middle East between August and October 2026.

The attackers used fake login pages impersonating government webmail portals and cloud storage services to steal credentials or deliver malicious files. They also used fraudulent Google Drive links and a fake video-meeting application called StarkMeet to distribute malware.

The campaign included phishing infrastructure impersonating the Gulf Cooperation Council (GCC) Secretariat General and regional diplomatic entities, suggesting potential targeting of other organisations across the Middle East.

Once installed, malicious components disguised as legitimate Windows RuntimeBroker software used GitHub repositories for command-and-control (C2) communications. The attackers selectively activated a second-stage backdoor, allowing them to execute PowerShell commands and steal data from compromised systems.

Researchers confirmed the compromise of a high-profile individual and a regional government cloud environment. At least 1 gigabyte (GB) of data was reportedly stolen from the latter.

Researchers linked the activity to threat groups tracked as UNC5795 and Dust Specter, with possible connections to Advanced Persistent Threat 34 (APT34).

RECOMMENDATIONS

Monitor for phishing attempts impersonating government webmail portals, Microsoft Outlook, Google Drive and online meeting services.

Enforce multi-factor authentication (MFA) across email, cloud services and privileged accounts to reduce the risk of credential compromise.

Restrict unauthorised application installations and verify the authenticity of software before execution.

Monitor for suspicious execution of RuntimeBroker.exe and dynamic-link library (DLL) loading from unusual directories, particularly %LOCALAPPDATA%\Microsoft\RuntimeBroker\.

Monitor for suspicious changes to the Windows Registry, particularly under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, which attackers may use to maintain persistent access.

VAPOR PANDA Uses AI to Scale Global Cyberespionage Campaign

Researchers identified a global cyberespionage campaign in which VAPOR PANDA used ARTEX, an AI-driven framework, to target more than 200 organisations worldwide. Supported by DeepSeek and another commercial large language model (LLM), the framework enabled the attackers to conduct multiple intrusions simultaneously.

The campaign targeted government ministries, telecommunications providers and organisations across the pharmaceutical, semiconductor, defence, nuclear and financial sectors. Targets spanned multiple regions, including the Middle East, where a government interior ministry was compromised. Researchers also confirmed post-compromise activity at nine organisations worldwide.

The attackers exploited security vulnerabilities and used stolen credentials to gain initial access, deploying web shells and the BLOODALCHEMY backdoor to maintain access to compromised systems.

Their activities also included password spraying, network reconnaissance, privilege escalation and identifying systems without endpoint security monitoring to evade detection.

The campaign highlights how AI-powered tools can help threat actors conduct sophisticated espionage operations at scale.

RECOMMENDATIONS

Rotate compromised or potentially exposed signing keys, pre-authentication keys and service credentials, including those stored in historical backups and directory exports.

Enforce Security Assertion Markup Language (SAML) signature validation and require Instance Metadata Service Version 2 (IMDSv2) on supported cloud instances to strengthen protection against unauthorised access to cloud credentials.

Apply least-privilege access controls to cloud roles and restrict administrative command execution to authorised instances.

Monitor for ARTEX-related indicators, including artx and artex in command-line parameters, cloud roles beginning with artx, administration-command comments beginning with art18-, and the directory C:\ProgramData\artx5v\.

Apply the latest available security patches and firmware updates to internet-facing applications, appliances and Linux servers.

Deploy and maintain Endpoint Detection and Response (EDR) solutions across all endpoints, including internal servers.

Splunk Releases Critical Security Fixes for SOAR Vulnerabilities

Splunk has released security fixes addressing two critical vulnerabilities in Splunk SOAR, identified during Cisco’s internal security review.

The fixes are part of a broader software hardening release addressing multiple internally discovered vulnerabilities, reflecting Splunk’s ongoing focus on security and product quality.

The update addresses two vulnerabilities, both rated Critical:

CVE-2026-76407: CWE-284 (Improper Access Control)

CVE-2026-76528: CWE-693 (Protection Mechanism Failure)

RECOMMENDATIONS

Ensure all affected systems are patched and updated.

Upgrade Splunk SOAR to version 8.7.0 or higher.

Google Chrome Releases 20 Security Fixes to Address Critical Vulnerabilities

Google Chrome has released 20 security fixes addressing 2 Critical, 16 High and 2 Medium-severity vulnerabilities.

The vulnerabilities involve memory corruption, use-after-free, integer overflow, improper input validation and out-of-bounds read issues across multiple browser components.

The update addresses the following CVEs

Critical (2)

CVE-2026-119263

CVE-2026-119261

High (16)

CVE-2026-76028

CVE-2026-76026

CVE-2026-76030

CVE-2026-119265

CVE-2026-119268

CVE-2026-119267

CVE-2026-119270

CVE-2026-119264

CVE-2026-119260

CVE-2026-76029

CVE-2026-76031

CVE-2026-119262

CVE-2026-119271

CVE-2026-119269

CVE-2026-119266

Medium (2)

CVE-2026-76027

CVE-2026-119272

Successful exploitation of certain vulnerabilities could allow remote attackers to access sensitive memory or execute arbitrary code within or, in some cases, outside the browser sandbox through specially crafted web pages.