SaudiNet

SaudiNet, also known as SaudiNet ISP, is an Internet Service Provider headquartered in Saudi Arabia. The organisation delivers internet connectivity services to customers and operates within the broader telecommunications sector. Its primary function is to enable users to access the internet through various broadband and data transmission technologies.

In early 2020, SaudiNet was identified as one of the telecommunications providers compromised by a threat actor linked to Hezbollah, known as Lebanese Cedar. The attackers exploited vulnerabilities in internet‑facing Atlassian and Oracle servers to gain initial access. Once inside, they deployed web shells to maintain persistence and used the Explosive RAT malware to exfiltrate sensitive databases, which likely contained client call records and private information. The intrusion was attributed to the group based on observed tool reuse, operational fingerprints, and overlapping infrastructure across multiple compromised servers globally.

The incident highlights SaudiNet’s exposure to sophisticated cyber‑espionage campaigns targeting critical communications infrastructure. Being based in Saudi Arabia, the organisation operates within the Kingdom's telecommunications sector and is subject to its regulatory environment. While no further details about its size, ownership, or subsidiary structure are publicly available in the provided material, its role as a provider of internet services contributes to digital connectivity in Saudi Arabia.