A June 8, 2026, intelligence report from Kaspersky GReAT confirms that 4BID and affiliated groups Hakerskii Kit, C.A.S., and Goffee have expanded their targeting beyond Russia and Belarus to include organisations in Kazakhstan, the UAE, Syria, and Egypt. Originally operating as politically motivated hacktivists, the groups are increasingly adopting ransomware tactics and shifting toward financially motivated operations. Their campaigns leverage Microsoft Exchange ProxyShell exploitation, such as .aspx web shells, commercial remote management tools, EDR-disabling kernel drivers, and the ClearWater and Blackout Locker ransomware strains. This combination of hacktivist activity, ransomware deployment, and advanced endpoint evasion capabilities significantly elevates the threat. UAE organisations running Microsoft Exchange Server, ASP.NET applications, or remote management tools such as AnyDesk should review their exposure and implement immediate protective measures.
Initial access in all confirmed 4BID campaigns is achieved through exploitation of Microsoft Exchange Server ProxyShell vulnerabilities, the critical chain of CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 that allows unauthenticated attackers to perform remote code execution on Exchange via a combination of authentication bypass, privilege escalation, and arbitrary file write. Despite these vulnerabilities being disclosed in 2021, unpatched Exchange deployments remain widespread globally and particularly across MENA enterprise environments. Post-exploitation begins immediately with deployment of fd.aspx, a custom web shell written in ASP.NET, designed to blend into legitimate Exchange or ASP.NET application directories. The fd.aspx shell provides the attacker with persistent HTTP-accessible command execution, file management, and lateral movement capabilities that survive reboots and Exchange service restarts.
After establishing the web shell, the attackers deploy a carefully sequenced post-exploitation toolkit. Remote monitoring and management tools, including AnyDesk and similar commercial RMM platforms, are installed to provide GUI-based remote access that blends with legitimate IT management traffic. Custom PowerShell and batch scripts perform reconnaissance, credential harvesting, and Active Directory enumeration. A Bring-Your-Own-Vulnerable-Driver (BYOVD) EDR killer is deployed to disable endpoint detection and response tools by exploiting a signed but vulnerable kernel driver, rendering CrowdStrike, Defender, and other EDR products ineffective. With defences neutralised, ransomware is deployed: ClearWater ransomware for general file encryption and financial extortion, and Blackout Locker, an updated version distributed via a Rust-based dropper for targeted destructive encryption. The Rust dropper writes the payload to AppData\Local\Microsoft\[REDACTED].dat and renames it to .exe before execution. The full attack chain is detailed below,
Delivery and Infection Chain:
The 4BID campaign follows a consistent and documented attack sequence confirmed by Kaspersky GReAT across all investigated victim environments. The full chain is as follows,
Technical Capabilities:
The BYOVD EDR-killing technique is the most operationally significant capability in the 4BID toolkit; it is what separates this campaign from lower-sophistication hacktivist operations. By exploiting a signed, legitimate kernel driver with a known vulnerability, the attacker gains kernel-level code execution to terminate EDR agent processes and kernel callbacks that would otherwise detect and block ransomware deployment. This technique has historically been associated with sophisticated ransomware-as-a-service groups such as BlackCat/ALPHV and Cl0p. Its adoption by hacktivist-origin groups confirms the capability convergence that Kaspersky GReAT flagged as the defining characteristic of the 4BID campaign. Blackout Locker's Rust-based dropper adds another layer of detection resistance: Rust-compiled executables are structurally different from the C/C++ malware that most AV signatures are trained on, and the AppData staging path impersonating a Microsoft directory is specifically chosen to evade automated suspicious-path detection rules.
ClearWater ransomware has been deployed in attacks linked to Hakerskii Kit, with public acknowledgements indicating coordination with C.A.S. Blackout Locker remains 4BID’s primary ransomware and was enhanced in January 2026 with a Rust-based dropper. The groups’ expansion into the UAE appears tied to a shift from primarily ideological objectives toward financially motivated targeting, meaning UAE organisations should consider themselves potential targets regardless of any connection to the groups’ original Russia-focused agenda.
Attribution and Evolution:
4BID and its affiliated groups are assessed by Kaspersky GReAT with medium-confidence links between the four distinct personas: 4BID, Hakerskii Kit, C.A.S., and Goffee. The groups share tooling, infrastructure, and operational coordination patterns. The broader cluster is assessed as Russian-speaking, politically motivated hacktivists who have integrated financially motivated ransomware operations as a revenue stream. Public statements from an alleged 4BID member indicating that Russian targeting is no longer profitable, combined with confirmed victims in the UAE, Kazakhstan, Syria, and Egypt, suggest a deliberate geographic expansion strategy. The groups operate primarily via Telegram for public claims and coordination, which provides attribution visibility and intelligence for defenders monitoring Telegram hacktivist channels.
Active Campaign and Geographic Spread:
UAE organisations are confirmed victims in the Kaspersky GReAT investigation. This is not a projected or theoretical risk; it is confirmed active targeting. The campaign specifically targets internet-facing Microsoft Exchange Servers (the ProxyShell entry point) and Windows environments with AnyDesk or similar RMM tooling. UAE enterprises with on-premises or hybrid Exchange deployments that have not applied the 2021 ProxyShell patches remain at direct and immediate risk. The expansion coincides with a broader pattern of Russia-affiliated and Eastern European threat actors pivoting to MENA targets as geopolitical and financial motivations shift, consistent with the 44% increase in underground recruitment by ransomware affiliates targeting GCC countries documented in Group-IB's 2025 report.
Conclusion:
The 4BID campaign represents the maturation of hacktivist groups into full-capability ransomware operators, combining the ideological framing of hacktivism with the financial motivation and technical sophistication of professional ransomware affiliates. For UAE organizations, the immediate priorities are clear: patch Exchange ProxyShell vulnerabilities immediately if not already done, audit for fd.aspx or similar web shells in Exchange and ASP.NET directories, monitor for AnyDesk installations outside approved IT management workflows, deploy BYOVD-resistant EDR configurations, and ensure ransomware-resilient offline backup coverage for all critical systems.
Successful 4BID exploitation results in full domain compromise via the ProxyShell-to-web-shell-to-domain-admin chain, followed by EDR neutralisation and simultaneous ransomware deployment across all reachable Windows endpoints. ClearWater and Blackout Locker both encrypt files and demand ransom. The hacktivist framing means payment does not guarantee decryption, as reputational damage and disruption are coequal goals alongside financial extraction. For UAE organisations, a confirmed ransomware incident triggers UAE PDPL breach notification obligations if personal data is encrypted or exfiltrated, NCA ECC mandatory incident reporting, and significant operational disruption to any business process dependent on encrypted systems.
https://securelist.com/hacktivists-broaden-attack-geography/120115/
