Iranian Cyber Espionage: Two-Year Undetected Control of Middle East Infrastructure

Summary

• Iranian state-backed hackers kept access to a Middle East critical infrastructure network for about two years.
• Fortinet’s FortiGuard team linked the intrusion to the group tracked as Lemon Sandstorm, also known as Pioneer Kitten or Fox Kitten.
• The attackers got in with stolen VPN credentials and probed systems tied to operational technology.
• The case shows how long a patient attacker can stay hidden in critical networks.

How the intrusion was found

Fortinet’s FortiGuard Incident Response team has detailed a long-running Iranian intrusion into critical national infrastructure in the Middle East. The attackers kept access from at least May 2023 to February 2025. Some signs of compromise date back to May 2021. Fortinet attributed the activity to an Iranian state-sponsored group tracked as Lemon Sandstorm.

An earlier version of this article attributed the discovery to Mandiant and named the group “Ruthenium,” with comments from Mandiant’s Charles Carmakal. Those details could not be confirmed and have been corrected. The group’s long dwell time is what stands out. Nearly two years inside a critical network without being caught is a serious failure of detection.

What the attackers were after

Critical infrastructure networks are prime targets for espionage. Fortinet found the attackers searched for and probed systems connected to operational technology, the equipment that runs physical processes. It did not find conclusive evidence that they broke into the production OT network itself.

A quote attributed to Red Canary’s Katie Nickels in an earlier version could not be verified and has been removed.

How they stayed hidden

The attackers first got in using stolen VPN credentials. Once inside, they deployed web shells and several custom backdoors, including Havoc, HanifNet, HXLibrary and NeoExpressRAT, to keep their foothold and move around.

When defenders pushed them out, they tried to get back in through other routes, including phishing and flaws in other software on the network, which shows how determined a state-backed team can be once it has decided a target is worth the effort.

Lessons for defenders

The case shows why critical infrastructure operators need better visibility into remote access. Stolen VPN credentials were the way in, and multi-factor authentication on every VPN account would have made that much harder.

A quote attributed to former PayPal CISO Michael Barrett in an earlier version could not be verified and has been removed. The practical advice stands. Patch internet-facing systems, watch for unusual logins and invest in threat intelligence that can spot known Iranian tools.

What comes next

State-backed espionage against infrastructure is a present-day problem. Old defenses fall short.

Fortinet’s findings are a reminder that the most dangerous intruders are often the quiet ones, and that a network can look healthy for years while someone else is reading its traffic.

Operators across the region, and well beyond it, should treat this case as a prompt to hunt for intruders who may already be inside.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.