An Iranian threat actor was seen targeting UAE organizations with polyglot files to deliver a new backdoor named Sosano.