A series of targeted intrusions tied to Iranian-linked actors has exposed a persistent threat to United Arab Emirates government networks and to the wider regional defense ecosystem. Researchers observed a PowerShell-based backdoor that leverages on-premises Microsoft Exchange infrastructure as a covert command-and-control channel while co-located web shells harvest login credentials from users who authenticate to those servers. These techniques turn routine email traffic into a data exfiltration pipeline and make detection much harder for defenders.

The implant identified by multiple vendors and called PowerExchange communicates via the Exchange Web Services API, sending stolen data and receiving base64-encoded commands as email attachments. Investigators also found a novel web shell, reported as ExchangeLeech or System.Web.ServiceAuthentication.dll, that can capture usernames and passwords submitted to Exchange when legacy or basic authentication is used. Abusing a victim’s own mail server in this way lets an operator blend malicious traffic with legitimate traffic and complicates network-level detection and blocking.

Separately, Mandiant documented related Iran-nexus campaigns that rely on convincing social engineering lures - fake recruiting sites and job offers - to harvest credentials and to deliver backdoors named MINIBIKE and its successor MINIBUS. Those campaigns show a consistent objective: gain footholds in aerospace, aviation, and defense-related organizations across the Middle East, including targets in the UAE, and then expand access using stolen credentials and tailored post-exploitation tooling. The focus on defense and aerospace increases the operational impact of any successful compromise.

Why stolen credentials matter for regional defense posture Credentials are the keys that unlock not only email and document stores but also administrative consoles, supply chain portals, VPNs, and identity providers. In a defense context these accounts frequently link to engineering data, procurement records, configuration files for unmanned systems, and trusted third-party connections. When an actor harvests credentials at scale and gains persistent access via backdoors, they can map networks, escalate privileges, and quietly collect intelligence that degrades operational security and decision advantage. The UAE cases demonstrate how relatively low-noise techniques - credential harvesting and use of legitimate infrastructure for C2 - can produce high-value intelligence over time.

Observed tradecraft and indicators Across the incidents publicized by researchers, common patterns emerge: spear phishing or fake job lures as the initial vector; dropper executables masquerading as benign documents; PowerShell-based implants for persistence and orchestration; and the abuse of Exchange servers for C2 and exfiltration. Some analyst writeups note scheduled tasks and masqueraded DLL filenames used to maintain persistence, and they highlight mailbox and Exchange traffic as a likely conduit for stolen credentials to leave the environment. These are useful detection hypotheses for defenders investigating unusual mailbox activity or anomalous outbound messages that contain attachments with unusual encodings.

Immediate defensive steps defenders should prioritize

  • Enforce modern authentication and disable legacy/basic authentication on Exchange and identity services where possible. Blocking basic auth removes one of the simplest credential-harvesting avenues.
  • Require and monitor multi-factor authentication for all privileged and remote access accounts. MFA greatly raises the cost of using harvested credentials.
  • Harden internet-facing email infrastructure: patch Exchange and email gateway appliances promptly, and scrutinize EWS activity and mailboxes for anomalous encoding or periodic outbound messages.
  • Hunt for web shells and suspicious DLLs on Exchange servers, and investigate scheduled tasks or autoruns with names that mimic update services. When found, assume credential exposure and rotate impacted credentials and certificates.
  • Reduce blast radius by applying least privilege to service accounts, segmenting mail infrastructure, and applying network-level controls that limit which hosts can directly access Exchange admin endpoints.
  • Train staff to recognize tailored job lures and spear-phishing themes used by these campaigns. Blocking untrusted links in email and treating unexpected attachments with suspicion are still effective first lines of defense.

Conclusion The incidents tied to Iranian-aligned actors illustrate a recurring lesson: credential theft combined with covert C2 techniques is an efficient path to sustained espionage inside high-value targets. For states and defense contractors in the Gulf, the operational consequence is real - loss of sensitive program data, degraded situational awareness, and adversary knowledge that can inform kinetic or influence operations. Defenders must treat internet-facing messaging infrastructure as a strategic asset that requires priority hardening, continuous monitoring, and an assumption of compromise posture when investigating suspicious activity. The time to adopt layered controls and rapid credential hygiene is now, because these adversaries prefer to operate quietly and persistently until they have what they need.