Both backdoors target Arabic-speaking users. They use code that checks if the compromised machine has the Arabic language installed. This way, the attacker avoids systems belonging to non-relevant individuals as well as most sandboxes, Cybereason researchers note