EMEA Bi-Monthly Threat Reports: Turkey, Saudi Arabia & United Arab Emirates
Summary: Unit 42's EMEA threat report for April and May found Turkey accounted for over three quarters of the malware samples and malicious sessions across Turkey, Saudi Arabia and the UAE, with almost 2,000 unique samples in over 27,000 sessions. Jaff ransomware shifted delivery in April from weaponized Word documents to PDFs containing embedded Word documents, and PdfDocmDropper accounted for almost half the samples in both Saudi Arabia and the UAE.
Key Takeaway: Attackers moved to PDF droppers specifically because security policies already restrict weaponized Word documents, so a control that worked is now being routed around with filenames like "Scan_920684.pdf" and "123-229928252-reg-invoice.pdf".
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026