Crafty Camel APT: Iran’s Expanding Espionage Footprint in the Modern Cyber Battlespace

What is Crafty Camel?

Crafty Camel is the name given to a cluster of targeted espionage-style phishing activity. A March 2025 news report links the name to a campaign against aviation, satellite communications and transport organizations in the UAE. It notes similarities to Iran-aligned activity but does not attribute the campaign to a specific country.

Public reporting on Crafty Camel is limited. The cited report describes one campaign that used spearphishing emails with polyglot files, and it does not name a state sponsor. The sections below are a general profile that goes beyond that report. Treat the Iran link, the start date and the wider target list as unconfirmed.

The cited report describes targeting of UAE aviation, satellite communications and critical transportation organizations. This profile also describes spearphishing combined with cloud-based compromise, which that report does not cover.

Proofpoint first described the activity as UNK_CraftyCamel. It reports the following:

• Fewer than five UAE organizations were targeted.
• The lures came from a compromised email account at an Indian electronics company.
• The files were polyglots that led to a backdoor called Sosano.

Proofpoint saw tactic similarities with the Iran-aligned groups TA451 and TA455. It assessed this as a separate cluster of activity (Proofpoint threat research; see also BleepingComputer’s coverage).

What does Crafty Camel want?

The profile below treats the group as serving Iranian state interests. The cited report does not attribute it to a state, so this is the post’s view only.

The group’s objectives include:

• Strategic Espionage: Gathering sensitive data related to government, defense, and energy sector information
• Surveillance: Evidencing dissident, non-governmental organizations (NGOs), academic research, and general policy analyst
• Movement and Influence: Supporting Iran’s geopolitical and geo-economic objectives by compromising organizations around Middle Eastern diplomacy, energy markets, and military
• Security Awareness: Monitoring telecommunication and insfrastructure for metadata and gaining visibility into networks.

The profile describes the group’s aims as long-term persistence and stealthy intelligence gathering rather than destructive activity. The cited report does not confirm these aims.

TTPs: Methods, Tools, and Access Strategies

The profile describes a mix of old and newer intrusion methods, with more weight on cloud accounts and stolen identities. The one confirmed campaign was narrower: polyglot files sent from a hijacked email account.

Initial Access

According to the profile, intrusions usually start with:

• Spearphishing emails impersonating trusted institutions, policy groups, or defense agencies.
• Thematic lures tied to Middle Eastern geopolitics or diplomatic events.
• Credential harvesting via malicious login pages or spoofed cloud portals.
• Exploitation of vulnerable VPN appliances, webmail interfaces, and Microsoft Exchange servers.

Any one of these can hand the attacker a login to the internal network or to a cloud identity. In the confirmed UAE campaign, the way in was a spearphishing email.

Persistence

To stay inside a network, the profile says the group uses:

• Lightweight backdoors embedded within scheduled tasks or startup services.
• OAuth token abuse and identity misconfigurations in cloud environments.
• Custom loaders designed to deploy reconnaissance tools without triggering antivirus detection.

A stolen identity leaves fewer traces than a malware file. That is why the profile puts identity abuse ahead of malware here.

Command and Control (C2)

Crafty Camel uses:

• HTTPS-based C2 channels that mimic legitimate traffic.
• DNS tunneling to hide communications within normal DNS queries.
• Compromised Middle Eastern hosting providers to stage payloads and exfiltrate data.
• Cloud storage platforms (e.g., OneDrive, Dropbox) to relay instructions or encrypted payloads.

Traffic like this blends in with normal office use of HTTPS, DNS and cloud storage, which makes it hard to single out.

Malware, Tools & Techniques

The profile lists both custom and public tools:

• Custom droppers for reconnaissance implants.
• Credential harvesters and mailbox scraping utilities.
• PowerShell and other Living-off-the-Land (LOTL) techniques.
• Public RATs repurposed for stealth and persistence.

Only one tool has a public name. Proofpoint tied the polyglot files to a backdoor called Sosano. The rest of this list is the profile’s general description.

What operations has Crafty Camel run?

The only operation backed by a cited public report is the campaign against UAE aviation, satellite communications and transport organizations described above.

Recent Developments (2024 to 2025)

The profile says the group has moved toward identity and cloud attacks as more companies run key services in the cloud. It lists these changes, which the cited report does not cover:

• Exploiting misconfigured identity providers.
• Using OAuth-based persistence mechanisms.
• Exploiting newly disclosed vulnerabilities in edge services.
• Using multi-stage phishing workflows across email, social media, and cloud messaging platforms.

It also describes more attacks on energy and transport networks in the Gulf. Telecom intrusions, in this view, may feed long-term intelligence work for Iranian military and strategic planners.

The profile also lists supply-chain vectors: breaking into an IT or telecom provider to reach its customers. The confirmed campaign had a similar shape, since its lures came from a compromised account at an Indian electronics company.

How can security teams defend against Crafty Camel?

In the post’s view, Crafty Camel is part of Iran’s cyber-espionage effort, with a focus on cloud identities, long-term surveillance and intelligence from government, defense and energy targets. The public record is thinner: one campaign against fewer than five UAE organizations.

The steps below cover both the confirmed campaign and the wider profile:

• Strengthen MFA enforcement and identity governance.
• Monitor for suspicious OAuth activity and cloud login anomalies.
• Apply rapid patching for VPNs, email servers, and exposed services.
• Harden telecom and IT supply-chain dependencies.
• Conduct threat hunting for credential harvesting indicators and LOTL activity.

If you work in aviation, satellite communications or transport in the Gulf, plan first for the confirmed pattern: polyglot attachments sent from a real, hijacked partner account.

You can download and review the sheet for all the details!