Keep Calm and (Don't) Enable Macros: A New Threat Actor Targets UAE Dissidents

The report documents Stealth Falcon, a suspected state-sponsored threat actor, carrying out a long-running targeted spyware campaign against UAE dissidents and other critics since 2012. It details social engineering, fake personas such as The Right to Fight and Andrew Dwight, macro-based backdoors, aax.me-based profiling, and a complex network of C2 servers, inferring ties to UAE government interests and highlighting the attacker’s operational security and scale.