1f3bd755de24e00af2dba61f938637d1cc0fbfd6166dba014e665033ad4445c0

Check Point Research (CPR) continuously tracks threats, following the clues that lead to major players and incidents in the threat landscape. Whether it’s high-end financially-motivated campaigns or state-sponsored activity, our focus is to figure out what the threat is, report our findings to the relevant parties, and make sure Check Point customers stay protected. Some of our work naturally makes it into the spotlight through public reports and deep blog posts. However, a large portion of what we uncover remains in the shadows but is used on a day-to-day basis to improve protections, connect the dots between incidents, and keep a watchful eye on known threat actors and infrastructure. In 2025, the activity varied by region and objective. In the Americas, attackers invested in high-value targets, including early ToolShell exploitation assessed as Chinese-nexus activity against North American government organizations. Identity-centric intrusion methods were also prominent, such as AiTM-enabled credential theft in targeted campaigns against researchers within US think tanks. In Europe, the year combined disruption, espionage, influence operations, and financially motivated intrusions. Russian-affiliated activity drove pressure in Eastern Europe and Ukraine, while Chinese and Iranian-nexus actors remained active, and election-related influence efforts persisted, including renewed targeting around Moldova’s parliamentary cycle. Across Asia Pacific and Central Asia, Chinese-nexus espionage was sustained, frequently relying on updated versions of established attack playbooks. In the Middle East and Africa, campaigns reflected a diversified mix of state-aligned operations, destructive activity, and PSOA-linked exploitation, with conflict periods amplifying targeted collection such as attempts to compromise internet-connected cameras. Across these threats, novelty more often came from how familiar techniques were combined than from entirely new tooling. Actors repeatedly used trusted platforms and common enterprise pathways: cloud hosting for command and control, remote administration tooling, DLL side-loading chains, and social engineering patterns such as ClickFix, to reduce detection and improve reliability. Overall, 2025 reinforced the need for durable visibility across identity, cloud, and endpoints, faster closure of exposed and unpatched entry points, and industry collaboration. Check Point Research Untold Stories Timeline – 2025 Key APT campaigns, cyberattacks & threat actor activity tracked throughout the year Jan APT36 Targeting Indian Aerospace Industry RedCurl Weaponized LNK Files Campaign Mar Stealth Falcon Exploits WebDAV 0-day in the Middle East and Africa Apr Samsung Security Release Fixes 0-day Lying Pigeon Campaign Targeting the Moldovan Elections May Flax Typhoon Targets IT Supply Chains in Taiwan GoldenSMTP Targeting Governments in Central Asia Jun Cameras Targeting by Iranian-Nexus Actors Handala Hack Wiper Muddy Water Activity in Israeli Municipality Jul ToolShell Intrusion SilverFox Attacks Web Servers Kimsuky Phishing Campaigns against the US Think Tanks YoroTrooper Targets Eurasian Economic Union Countries Aug Camaro Dragon Targeting Government Sector UAC-0050 Phishing Campaign Zipline Shifting to Europe WIRTE Espionage and Sabotage Sep WhiteLock Ransomware Oct COLDRIVER in Southeast Europe Dec Nimbus Manticore Activity in Africa Figure 1 – Overview of CPR Untold Stories 2025. Americas Throughout the year, the Americas were a focal point for both nation state activity and high-end cybercrime, with a wide mix of actors targeting government and private-sector organizations alike. The state-sponsored groups in particular seem to reserve some of their most innovative tradecraft for targets in the Americas. Whether through zero-day exploitation, abuse of cloud services, or highly refined phishing operations, attackers appear willing to invest more time and sophisticated efforts for targets in this region. ToolShell Exploitation Used as a Zero-day by Chinese-nexus Actors ToolShell is an exploit chain targeting on-premises Microsoft SharePoint and enables unauthenticated remote code execution (RCE) on vulnerable servers. It works by abusing weaknesses in how SharePoint handles certain web service / API requests, which allow attackers to reach code execution without needing valid credentials. ToolShell’s involvement in active exploitation efforts has been observed globally. While analyzing in July the broader wave of ToolShell activity, we found a subset of targeted incidents where the exploit chain appears to have been used as a zero-day, before the original patch was available. In each of these limited early exploitation attempts, the targets were government-sector organizations in North America. We attribute the zero-day exploitation activity to Chinese-nexus threat actors. This assessment is based on the supporting infrastructure we observed in this campaign, which includes router-based relay nodes consistent with Operation Relay Box (ORB)-style networks, an approach most frequently seen in intrusions attributed by multiple vendors to Chinese nexus groups. This assessment aligns with Microsoft Threat Intelligence report that Chinese APTs exploited the vulnerability as a zero-day. Figure 2 – ToolShell Exploitation Timeline. Kimsuky Targeting Think-Tanks in the US Since mid-July, we’ve been tracking a targeted phishing campaign aimed at researchers within US think tanks which focus on North Korean affairs and policy. The campaign relies on spear-phishing emails, often impersonating peers from European universities or NGOs, with invitations to collaborate or participate in academic or policy events. The malicious emails contain either a link or a PDF attachment embedding a QR code, both of which lead to web pages impersonating legitimate organizations. Figure 4 – Example of a phishing landing page (hosted at signup-forms[.]theonlycompany[.]com), explaining the login request. The landing pages claim a login is required and include a button that redirects victims to credential-harvesting sites tailored to their email providers, such as Yahoo, Gmail, or Microsoft. The phishing infrastructure leverages Adversary-in-the-Middle (AiTM) kits to bypass MFA and gain unauthorized access to victims’ email accounts. RedCurl Weaponizes LNK files RedCurl is a sophisticated, Russian-speaking threat actor historically tied to corporate espionage, and most recently, to ransomware operations. The actor has targeted North American entities for years. In more recent activity affecting North America and Asia, we observed a new multi-stage infection chain that pulls a remote resource by abusing the Working Directory parameter in LNK files. The LNKs point to a legitimate Windows binary (such as conhost or rundll32), and pass an argument that references a file located in that remote working directory production[.]dav[.]indeedex[.]workers[.]dev. This combination of living-off-the-land execution, using WebDAV and remote resource loading, appears to contribute to exceptionally low detection rates. While we haven’t observed clear post-exploitation activity in our data, we did see indications suggesting the intrusion path may ultimately lead to the deployment of RedCurl’s custom ransomware. Europe The activity we observed in Europe ranges from operations designed to disrupt, to those intended to influence and mislead, to financially motivated campaigns. Together, these threats threaten every pillar of data security: confidentiality, integrity, and availability. The most aggressive activity is driven by Russian-affiliated actors, especially in Eastern Europe and Ukraine, where they employ a mixture of tactics consistent with aims of espionage, disruption, and “hacktivism.” At the beginning of 2025, we reported on one major espionage campaign, attributed to APT29, which targeted foreign affairs ministries. However, Russia nexus actors isn’t the only major player in this arena: Europe continues to face sustained pressure from Chinese and Iranian nexus threat actors as well, alongside a steady stream of financially-motivated groups targeting the continent. Camaro Dragon Targeting Government Sector In 2025, we tracked multiple Chinese-aligned actors targeting Europe. Within this broader set of operations, we observed a recurring campaign against European government agencies that looks like an evolution of the SmugX activity we reported in 2023. The campaign, likely a subset of Camaro Dragon (also known as Mustang Panda), uses well-crafted phishing to deliver PlugX payloads. The initial infection begins with spear-phishing emails sent from what appear to be government addresses, either compromised mailboxes or spoofed senders, targeting Foreign Affairs ministries across Europe. The messages contain a hyperlink to an HTML landing page hosted on Microsoft Azure’s cloud-based web storage service (*.web.core.windows.net). Figure 5 – Camero Dragon’s Infection Chain. When opened, the HTML executes a short, embedded JavaScript snippet that reconstructs and launches a download link. The script dynamically assembles the next stage URL using ASCII-encoded fragments, then redirects the browser to download an archive file such as 262a1003a2cd04993b29e687686eba573d6202fea8611c437ecbd6312802677a. This archive contains a Windows shortcut (LNK) file that serves as the dropper for the next stage. COLDRIVER in Southeast Europe Despite multiple recent public exposures, the Russian affiliated threat group COLDRIVER (also tracked as UNC4057, Star Blizzard, and Callisto) has not slowed down or paused its activity. Instead, the group continues to rapidly adapt its operations. In Q4 2025, we observed multiple campaigns impersonating US-based nonprofit organizations, including NED (National Endowment for Democracy) and USRF (The US–Russia Foundation), as well as campaigns targeting Southeast Europe that use fake websites impersonating a major regional media and broadcasting company. These campaigns highlight the group’s ability to quickly evolve its tooling and delivery mechanisms in response to exposure. As part of this evolution, COLDRIVER introduced changes to its multi-stage MAYBEROBOT (also known as SIMPLEFIX) malware delivery chain. Beginning with ClickFix-style self-infection, the updated chain incorporates additional stagers with enhanced attacker-side security measures, such as DGA and RSA-based authenticity checks for C2 communications. Figure 6 – ClickFix-style attack staged using a fake United Media website. Lying Pigeon Campaign Targeting the Moldovan Elections In 2024, we exposed Operation MiddleFloor, a campaign in Moldova by the Russian-speaking group Lying Pigeon. Ahead of the October 2024 presidential elections and EU referendum, the group used spoofed emails and forged documents, impersonating EU institutions, Moldovan ministries, and political figures to spread anti-European narratives. We also discovered that previously, Lying Pigeon also targeted other major European political events, including the NATO 2023 summit in Vilnius and Spain’s 2023 general elections. Since mid-April 2025, we observed a new wave of activity aimed at Moldova’s September parliamentary elections. Most of this activity used the same techniques as the MiddleFloor campaign, spreading fake documents to erode trust in Moldovan pro-European leadership. In addition, at the end of May, Lying Pigeon launched a large-scale defamation campaign using over a dozen domains to promote a poster contest attacking PAS, the ruling Party of Action and Solidarity founded by President Maia Sandu. Though framed as citizen-led, it was a coordinated propaganda and disinformation effort running on Lying Pigeon infrastructure. Interestingly, the contest site itself was cloned from a website of a Russian anti-terrorism poster competition held in 2024. In August, a phishing campaign targeting multiple organizations in Ukraine was launched from compromised email accounts. The emails masquerade as communications from the Ukrainian tax authorities and contain a malicious link to the 4sync.com file sharing service, prompting recipients to download a malicious archive named tax_gov_ua_zapit_15_08_2025_X.zip. Upon successful execution, a Remote IT support tool is installed on background, granting unauthorized access to the threat actor. This campaign shares similarities with UAC-0050. Figure 8 – UAC-0050 Phishing masquerading as tax.gov.ua. Zipline Shifting to Europe Earlier this year, we reported a sophisticated phishing campaign targeting US organizations with unusually elaborate social engineering. The campaign, named ZipLine, was noteworthy because the attacker reached out through the victim’s public “Contact Us” form, reversing the typical phishing flow and prompting the organization to initiate the email exchange. Since that publication, we’ve seen a noticeable shift in both the group’s TTPs and its targeting, with a clear refocus on Europe. Recent waves lean heavily on HR-themed lures, and our data suggests the actor is running country-by-country campaigns, most notably against the UK, Poland, Italy, and the Czech Republic. The tooling also appears to have evolved into newer iterations of MixShell, with the actor now relying almost entirely on herokuapp domains for C2 communication. Figure 9 – Zipline lure targets Europe. Asia Pacific and Central Asia The activity we observed across Asia reflects a sustained regional espionage push by Chinese-aligned actors. For much of the year, the dominant TTPs (Tactics, Techniques, and Procedures) we saw were best described as updated versions of familiar playbooks: reusing modular backdoor ecosystems such as PlugX and ShadowPad, and repeating patterns that were effective for these groups in the past. At the same time, a smaller subset of APT activity stood out for being more deliberate and mature, reflecting a higher investment in tradecraft and operational discipline than the broader baseline we typically see in the region. However, the picture on the ground is still unclear as many of the same environments are targeted by multiple actors over long periods, leaving behind overlapping infrastructure, tooling, and artifacts. This creates an intertwined landscape that can be difficult to untangle, especially in Southeast Asia. GoldenSMTP Targeting Governments in Central Asia Throughout 2025, we observed multiple instances of activity that we determined to be an evolution of the IndigoZebra APT. These events primarily target Central Asia and rely on a mix of backdoors and supporting tools. Initial access is typically delivered via password-protected ZIP archives using phishing-style filenames, followed by DLL hijacking to install the first backdoor. Across the intrusion chain, we also saw a broader toolkit that included Pandora RC installer (open-source IT remote control software), shellcode loaders, and the NPPSPY credential stealer. Figure 10 – GoldenSMTP masquerades as SentinelOne Agent using debug strings. Next, the attackers deploy a dedicated SMTP/IMAP-based implant, named GoldenSMTP, which communicates through attacker-controlled email accounts, often named after local athletes, inside the target organization. This unusual C2 channel, combined with the use of compromised systems, appears to be at least partly responsible for the notably low detection rates of the backdoors installed in the later stages of the intrusion. Several of the samples showed code overlaps with older IndigoZebra malware, and the operation itself reflects familiar patterns: targeting Central Asia, reusing older infrastructure, relatively simple obfuscation, and checks for Russian-language systems. Flax Typhoon Targets IT Supply Chains in Taiwan We observed an intrusion set at a Taiwan-based cloud service provider where the threat actor abused legitimate security products to execute a DLL side-loading chain. The side-loaded DLL acted as a PlugX loader, which then brought in multiple plugins and injected them into other processes, with capabilities such as reverse shell access and keylogging. In this case, the built-in nslookup.exe utility was used to initiate C2 communication. After establishing a foothold, the attackers scanned the network and moved laterally using RDP. We also identified a SoftEther VPN binary placed at C:\Windows\SysWOW64\conhost.exe, a technique that other security vendors linked to the APT group known as Flax Typhoon. Flax Typhoon has been flagged by US government agencies as a major cyber risk for the technology ecosystem, including managed service providers (MSPs) and other IT service providers. SilverFox Attacks Web Servers The SilverFox APT group continues to target organizations across East Asia, with a particular focus on Taiwan and Japan, using a multi-stage backdoor known publicly as ValleyRAT. As part of the infection chain, the group employs a “bring your own vulnerable driver” (BYOVD) technique to terminate security product processes and reduce the chances of detection. We also identified a newly observed initial access vector: compromised PHP servers exposed to remote code execution. After successful exploitation, the group leverages the legitimate Windows msiexec component to install a ValleyRAT implant from hxxp[:]//aadcasc[.]cn-nb1[.]rains3[.]com/100ww.msi. Figure 11 – ValleyRAT web exploitation chain. YoroTrooper Targets Eurasian Economic Union Countries Throughout 2025, YoroTrooper, a threat group active in CIS countries since at least 2020, was observed targeting member states of the Eurasian Economic Union (EAEU) countries and its regulatory body, the Eurasian Economic Commission. Targets included government and diplomatic entities, as well as infrastructure projects in these countries. The attackers used PDF documents to lure victims to either phishing pages that steal credentials or to cloud-based file sharing services hosting malware. Consistent with other YoroTrooper campaigns, the threat actors deployed “burner” RATs as payloads, typically leveraging services such as Telegram and Discord for C2 communications. Figure 12- Example of phishing PDF document (549df969dc5b340b4fc850584a01c767ca8a1bd712f16210f164f85e26c3e58b) targeting government entity in Kyrgyz Republic. APT36 Targeting Indian Aerospace Industry At the beginning of 2025, we identified a targeted phishing campaign aimed at government entities and the Indian aerospace industry. Based on infrastructure overlap, targeting focus, and operational tradecraft, we can attribute the activity with moderate confidence to APT36. Phishing emails, with the subject line “RFI for Surveillance Systems for [REDACTED] State Police,” were sent from a compromised legitimate local Indian government email account, lending significant credibility to the lure. The campaign leveraged ISO attachments containing malicious LNK files, which executed embedded batch scripts. These scripts deployed a stealer malware capable of exfiltrating documents and other sensitive files from compromised hosts, and shares code similarity with ObliqueRAT. Later in the year, we observed additional activity consistent with this campaign targeting entities in Afghanistan, indicating an expansion of the threat group’s operational scope. Figure 13 – Snippet of PDF lure targeting the Indian aerospace industry. Middle East and Africa Recent activity across the Middle Eastern and North African (MENA) region reflects a diversified threat landscape with state-aligned advanced persistent threat (APT) groups, private sector offensive actors (PSOAs), and destructive operators deploying wipers. Campaigns blend legacy social engineering with increasingly disciplined operational planning, and use legitimate cloud apps, and code-signing or supply chain-style trust signals to lower detection rates. Private Sector Offensive Actors Some of the more distinctive activity we’ve been tracking is commonly associated with what are known as Private Sector Offensive Actors (PSOA). Many of the PSOA-linked clusters we observed this year were active in the Middle East, where this type of innovative capability continues to surface. One of our prominent findings was the discovery of a zero-day exploited by StealthFalcon: CVE-2025-33053, a vulnerability used to target high-profile organizations in Turkey, Qatar, Egypt, Ethiopia and Yemen. StealthFalcon, however, is not unique. Throughout 2025, we identified additional activity clusters that stood out in terms of their behavior and tradecraft. We came across one of them while tracking high-profile sample submitters in the Middle East. The activity consisted of a cluster of suspicious TIFF (an image file format for storing raster graphic images) files that contained embedded ELF payloads aimed at Android devices. Our analysis indicated the files were exploiting a vulnerability, later disclosed as CVE-2025-21042, in the way Samsung parses TIFF/DNG files. Based on the tradecraft, infrastructure overlaps, and recurring keywords like “Bridge Head,” we assess the operator to be a private sector offensive actor. Additional research into the same activity, called LANDFALL, reached similar conclusions. We saw indications the campaign affected targets in Iraq, Iran, Turkey, Bahrain, Morocco and Pakistan. Iranian Activity Israeli-Iranian War: Targeting Cameras During the twelve-day Israeli–Iranian war in June, threat actors largely stuck to their familiar playbooks, primarily using spear phishing campaigns to deploy wipers and backdoors. One standout trend we observed was a sharp increase in attempts to compromise specific Israeli cameras by exploiting CVE-2023-6895 and CVE-2017-7921 via infrastructure we associate with Iranian actors. In several major conflicts in recent years, compromising internet-connected cameras proved to be an effective way to support bombing damage assessment (BDA) by providing near–real-time visibility into strike impacts. This wave targeting Israeli cameras appears to fit that pattern and aligns with prior public disclosures by Israeli officials that Iran-nexus actors seek access to private CCTV feeds to assess the accuracy of their missile strikes and refine subsequent targeting efforts. Figure 14 – Spike in cameras targeting in Israel. MuddyWater Password Spray in Israeli Municipality In late June, a successful password spray activity originating from a Nord VPN infrastructure affected a municipal government in Israel. One month later, we observed a successful login attempt from the same attacker infrastructure to an email account which then sent spear phishing emails to recipients in Israel. The phishing email contained an embedded link, hxxps[:]//pharmacynod[.]com/join/join.html, used as a decoy invitation to join a Teams conversation. The landing page is a ClickFix page that tricks the user into pasting a PowerShell script into the Run dialog and executing it. This script is a RAT which initially collects information about the infected machine and can execute arbitrary PowerShell commands received from the command and control server. This script’s obfuscation method aligns with previous PowerShell backdoors associated with MuddyWater. Figure 15 – MuddyWater ClickFix Teams lure. Nimbus Manticore Activity in Africa We recently uncovered a long-running campaign that we attribute to Nimbus Manticore, an IRGC-affiliated actor active across the region and parts of Europe. What we observed highlights this actor’s evolution: while continuing to lean on familiar phishing themes, the actor has also begun deploying more sophisticated malware, making himself something of an outlier compared to much of the broader Iranian threat landscape. As we continue to track this operation, we’ve observed renewed activity targeting Northeast Africa, impersonating T-Mobile with a fake hiring website careerst-mobile[.]com and using similar tradecraft which suggests the campaign remains active and adaptable. Figure 16 – Renewed Nimbus Manticore phishing activity targeting Africa with impersonated T-Mobile site. Iran-Nexus Wipers Throughout the year, multiple Iran-aligned actors targeted Israel with disruptive campaigns involving wipers and ransomware. These operations, often at least partly opportunistic, are designed to interfere with the day-to-day functioning of Israeli organizations. Among the most prominent groups behind this activity are Void Manticore (Handala Hack) and Cotton Sandstorm, carrying out attacks using ‘WhiteLock’ ransomware, deployed after WezRat infostealer. Figure 17 – ‘WhiteLock’ ransomware chat server. One such campaign, likely conducted by Handala, involved a phishing email sent to hundreds of organizations across Israel. The messages were delivered from a compromised account belonging to an Israeli CRM solution provider. Recipients were instructed to “back up” their files by downloading a malicious .msi installer (6eb7dbf27a25639c7f11c05fd88ea2a301e0ca93d3c3bdee1eb5917fc60a56ff) hosted on Mega file share. When executed, the installer deployed a wiper that iterates over user file folders and overwrites files with spaces. In parallel, a malicious PowerShell script changed the user’s desktop wallpaper to display a political message tied to the Israeli-Hamas war. WIRTE: Espionage and Sabotage At the end of 2024, we published research connecting a wave of destructive activity in Israel, known as ‘Cyber Toufan Al-Aqsa’, to WIRTE, a Hamas-associated threat actor. In 2025, the group continued its destructive operations with new variants of SameCoin wiper, while also running parallel campaigns aimed at Arabic-speaking political entities across the Middle East, with a particular focus on Jordan and Egypt. In these campaigns, targets are lured into downloading a malicious archive (1f3bd755de24e00af2dba61f938637d1cc0fbfd6166dba014e665033ad4445c0) from a Dropbox URL. After the archive is extracted, the victim is presented with a benign Microsoft binary and a decoy file bearing an Arabic-language filename, which the user is prompted to open. That execution triggers DLL side-loading, pulling in a malicious DLL that serves as a loader. It also exfiltrates Base64‑encoded host information to a remote C2 server, and downloads and executes an additional payload, most commonly Havoc. In recent activity, the attacker used DigitalOcean-hosted infrastructure for C2 instead of the Cloudflare-backed setup that featured in previous longer-running operations. Figure 18 – Wirte Arabic-language lure. Conclusion Looking back at 2025, the threat landscape became more crowded, messy, and increasingly interconnected. Across different regions, we saw state-backed groups, private offensive actors, and high-end cybercrime operating side by side, sometimes even within the same networks. Zero-days, cloud-focused intrusions, and well-crafted phishing are no longer just rare outliers; we observed them repeatedly in multiple attacks as practical, reliable ways to get results. At the same time, many of the campaigns we uncovered show that novelty often lies less in entirely new tooling and more in how familiar techniques are combined and deployed. Actors reused infrastructure, malware frameworks, and social engineering themes, but adapted them to new targets, regions, and operational goals. In several cases, incomplete or internal-only research threads offered insight into how attackers test ideas, quietly iterate, and refine their approach over time. Ultimately, these observations reinforce the need for sustained visibility, collaboration, and context-driven research. Threat actors continue to invest where impact matters most, while opportunistic campaigns exploit gaps that are overlooked or left unpatched. By sharing these stories, both the well-known and the previously untold, we hope to contribute to a clearer picture of attackers’ behavior and help strengthen collaboration between security researchers and vendors moving forward. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

In recent months, we have been analyzing the activity of an advanced persistent threat (APT) known for its espionage activities against Arabic-speaking government entities. We track this Middle Eastern threat actor as Ashen Lepus (aka WIRTE). We share details of a long-running, elusive espionage campaign targeting governmental and diplomatic entities throughout the Middle East. We discovered that the group has created new versions of their previously documented custom loader, delivering a new malware suite that we have named AshTag. The group has also updated their command and control (C2) architecture to evade analysis and blend in with legitimate internet traffic. Ashen Lepus remained persistently active throughout the Israel-Hamas conflict, distinguishing it from other affiliated groups whose activities decreased over the same period. Ashen Lepus continued with its campaign even after the October 2025 Gaza ceasefire, deploying newly developed malware variants and engaging in hands-on activity within victim environments. This campaign highlights a tangible evolution in Ashen Lepus's operational security and tactics, techniques and procedures (TTPs). While its operations over the years have demonstrated only moderate sophistication, the group has recently adopted more advanced tactics that include: Enhanced custom payload encryption Infrastructure obfuscation using legitimate subdomains In-memory execution to minimize forensic artifacts Palo Alto Networks customers are better protected from the threats described in this article through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. We investigated a campaign waged by a Hamas-affiliated threat group that has been active since 2018. Their operations focus on cyber-espionage and intelligence collection, targeting government entities across the Middle East. We attribute this activity with high confidence to Ashen Lepus. Our attribution is based on Unit 42's Attribution Framework, and takes into account the network infrastructure, modus operandi and malware that the group has used throughout their campaigns. The attribution artifacts are detailed in Appendix A. Ashen Lepus is known for targeting entities in close geographical proximity, such as the Palestinian Authority, Egypt and Jordan. Recent campaigns show a significant expansion in operational scope – according to recent uploads to VirusTotal, the group is now targeting entities in other Arabic-speaking nations, including Oman and Morocco. Despite the broader geographic footprint seen in their recent attacks, the group's lure themes remain largely consistent. The majority of lure themes continue to relate to Middle East geopolitical affairs, mainly those involving the Palestinian Territories. However, the current campaign shows an increase in lures related to Turkey and its relationship with the Palestinian administration. Table 1 details these themes. Table 1. Lure themes used in a recent Ashen Lepus campaign. Since at least 2020 [PDF], Ashen Lepus has employed a consistent, multi-stage infection chain delivering a new malware suite that we call AshTag. The chain typically starts with a benign PDF decoy file that guides targets to a file-sharing service to download a RAR archive containing a malicious payload. Figure 1 shows two lure examples, relating to discussions conducted by the League of Arab States and United Nations Security Council. Downloading and opening the RAR archive initiates the chain of events that leads to an infection. This infection involves the following three files: A binary file masquerading as a sensitive or political document A malicious loader, which runs in the background An additional decoy PDF file named Document.pdf When the targeted individual runs the binary in order to read the article, the binary side-loads the first malicious loader (netutils.dll), which in turn opens the decoy PDF file for viewing. Figure 2 illustrates the initial infection chain in Cortex XDR, showing alerts triggered by the Windows executables responsible for DLL side-loading and persistence. Comparing this campaign with past campaigns shows that there has been a change in the group's C2 domain naming convention. Instead of hosting its C2 servers on its own domains, the group now registers new API and authentication-related subdomains of legitimate domains. This change is part of the group’s shift to adopt better operational security (OpSec), and helps its activity blend in with benign network activity. The domains often have technology or medical themes, such as api[.]healthylifefeed[.]com, api[.]softmatictech[.]com and auth[.]onlinefieldtech[.]com. We also observed a clear separation between different servers for different tools within the execution chain. The domains have varying formats and are hosted in multiple autonomous system numbers (ASNs). Since the servers are geofenced, automatic analysis tools cannot execute the entire chain to link between the different stages. In this campaign, the group took several cautionary measures to avoid detection and analysis. For instance, the secondary payloads are embedded within HTML tags of a seemingly benign webpage. Also, the C2 server performs initial checks on the victim's endpoint, to avoid sending the payload to sandbox environments. The server checks the victim’s geolocation, and checks specific User-Agent strings in the traffic that are unique to the malware. The AshTag campaign marks a significant upgrade to the group's traditional tooling. In previous campaigns, the actors did not deliver a full payload, and instead terminated the parent process using a simple .NET DLL. We assess that previous campaigns observed in the wild were a testing phase in the development of the attack chain. However, in this campaign, Ashen Lepus is deploying a more sophisticated, fully featured malware suite, which we have named AshTag. Unit 42 designates the name “Lepus” to threat groups associated with the Palestinian Territories, and we labeled the malware components “Ash” to reflect the basic, gritty attack resources that accumulate to choke system defenses, allowing the full attack to take hold. AshTag is a modular .NET toolset currently in active development, with extensive features, including file exfiltration, content download and in-memory execution of additional modules. The AshTag infection chain unfolds as follows: A targeted victim clicks the binary file, expecting to open a document. The binary file side-loads a DLL in the background. This DLL is the first malicious loader, which we call AshenLoader. AshenLoader opens the decoy PDF document on the desktop. In the background, AshenLoader retrieves and runs another side-loaded DLL: a stager that we call AshenStager. AshenStager retrieves and runs the AshTag payload. AshenStager also sets its persistence via a scheduled task, executed by svchost.exe. Figure 3 depicts the complete attack chain. When AshenLoader is executed, it tries to collect and send initial reconnaissance data to the attacker’s C2 server. The AshenStager payload is embedded within the C2’s webpage, between the custom HTML tags – an embedding method that has been documented in the past. In addition to these similarities, we identified new features of AshenLoader, described in Appendix B. AshenLoader retrieves and executes a stager that we dub AshenStager. In past campaigns, this stager was named Stager-X64, following its internal naming by the attackers. We now track AshenStager as part of the AshTag malware suite. AshenStager is side-loaded by a legitimate executable paired with a malicious custom DLL, named wtsapi32.dll. AshenStager is designed to send an HTTP request to its C2 server, where it parses the HTML response to extract another encrypted payload that is hidden within tags. After extracting the payload, AshenStager decodes, parses and injects the payload in memory. The final payload in this chain is a malware suite, which is orchestrated by a tool that we call AshenOrchestrator. Figure 4 shows the orchestrator’s Base64-encoded payload embedded in HTML content from the C2 server. AshTag is a modular .NET backdoor designed for stealthy persistence and remote command execution. AshTag masquerades as a legitimate VisualServer utility to evade suspicion. In reality, this backdoor is a multi-feature malware suite that uses AshenOrchestrator to conduct communication and to execute other payloads in memory. When AshenStager retrieves AshenOrchestrator’s payload, the stager receives a Base64-encoded JSON file. The JSON file contains the payload and the payload’s configuration. The configuration contains parameters such as specific URL paths that lead to different modules, encryption keys and the C2 domain. The configuration also includes sleep time buffers (jitter), mn and mx, which are used to avoid detection of the C2 beaconing. Figure 5 shows an example of such a configuration. Like most of the tools used in this campaign, AshenOrchestrator extracts its next payload from embedded HTML tags. However, in this instance, the payload is even more well hidden. Instead of using a hardcoded tag name, the stager searches for a specific commented-out tag within the HTML page that contains the relevant tag name. Figure 6 demonstrates the payload embedding scheme. AshenOrchestrator creates a unique AES key from the tg and au parameters, and decrypts the xrk XOR encryption key. The decrypted XOR key is then used to decrypt the embedded HTML value that contains the payload. The payload itself is a specific module contained in another Base64-encoded JSON that has additional configuration parameters. These parameters determine the module’s loading method name (mna) and class name (cn). Table 2 lists the different class names that AshenOrchestrator expects and their inferred functionalities. Table 2. Different Ashen modules and their inferred purposes. The mna value dictates the action that AshenOrchestrator performs for each module that it retrieves. There are four possible actions: Upload additional content Download the module to disk Execute the module as a .NET assembly Inject the module into memory Analyzing the injection method revealed that its code was not actually implemented, and only returned false, indicating that certain aspects of the AshTag malware suite are still in active development. Retrieving the different modules for analysis was a complicated task, in part because Ashen Lepus appears to be actively rotating the modules that are hidden within webpage content. This would explain why not all modules are available at the same time. In addition, we found that different encryption keys open different types of modules. Despite these complicating factors, we were able to retrieve one of the modules responsible for system fingerprinting – internally named the SN module. The module is an extremely simple .NET program that executes WMI queries and sends a unique victim ID back to the attackers. Figure 7 shows the main function of the SN module. We identified the threat actor’s operations in our telemetry, which indicated that they used additional modules to stage and exfiltrate files. Following the initial automated infection, the threat actor accessed the compromised system to conduct hands-on data theft. A few days after the original infection, the attackers loaded a custom module via AshenOrchestrator and began staging specific documents in the C:\Users\Public folder. Our analysis indicates that the threat actor downloaded these documents directly from a victim’s mail accounts, revealing the group’s main objective: obtaining specific, diplomacy-related documents. This aligns with past reports of the group’s practice of obtaining intelligence relating to regional geopolitical conflicts. To exfiltrate the staged files, Ashen Lepus downloaded the Rclone open-source tool, transferring the data to an attacker-controlled server. This appears to be the first time this threat group has been observed using Rclone for data exfiltration. In doing so, Ashen Lepus joins a growing number of actors who leverage legitimate file transfer tools to blend their malicious activity with benign network traffic and avoid detection. Ashen Lepus remains a persistent espionage actor, demonstrating a clear intent to continue its operations throughout the recent regional conflict – unlike other affiliated threat groups, whose activity significantly decreased. The threat actors’ activities throughout the last two years in particular highlight their commitment to constant intelligence collection. During this campaign, Ashen Lepus has begun to deliver its new malware suite, AshTag. AshTag is a modular .NET suite, capable of data exfiltration, command execution and in-memory payload execution. While the group's core TTPs are not highly sophisticated, this campaign reveals an evolution in its approach. We observed a clear effort to improve operational security by enhancing payload encryption, shifting infrastructure to innocent-looking subdomains and executing payloads in memory. This "low-cost, high-impact" methodology allows the threat actors to effectively evade static defenses and thwart analysis. The expansion of Ashen Lepus’s victimology beyond their traditional geographic targets, coupled with new lure themes, suggests a broadening of its operational scope. We assess that Ashen Lepus will continue to adapt its toolset and targeting to pursue its geopolitical intelligence objectives. Organizations in the Middle East, particularly in the governmental and diplomatic sectors, should remain vigilant against this evolving threat. Palo Alto Networks customers are better protected from the threats described in this article through the following products and services: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM - Cortex XDR helps to prevent the threats described in this blog, by employing the Malware Prevention Engine. This approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, to help prevent both known and unknown malware from causing harm to endpoints. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 Hashes of Malware Samples RAR Archives 3502c9e4896802f069ef9dcdba2a7476e1208ece3cd5ced9f1c4fd32d4d0d768 1f3bd755de24e00af2dba61f938637d1cc0fbfd6166dba014e665033ad4445c0 4e1f7b48249dd5bf3a857d5d017f0b88c0372749fa156f5456056767c5548345 3d445c25752f86c65e03d4ebed6d563d48a22e424ba855001ad2db2290bf564c 7e5769cd8128033fc933fbf3346fe2eb9c8e9fc6aa683546e9573e7aa01a8b6b AshenLoader Variant #1 f554c43707f5d87625a3834116a2d22f551b1d9a5aff1e446d24893975c431bc - dwampi.dll a17858f40ff506d59b5ee1ba2579da1685345206f2c7d78cb2c9c578a0c4402b - dwampi.dll ebe3b6977f66be30a22c2aff9b50fec8529dfa46415ea489bd7961552868f6b5 - dwampi.dll 8870bd358d605a5685a5f9f7785b5fee5aebdcb20e4e62153623f764d7366a3c - dwampi.dll 2d71d7e6ffecab8eefa2d6a885bcefe639fca988bdcac99e9b057e61698a1fd6 - dwampi.dll 8c44fa9bf68341c61ccaca0a3723945543e2a04d9db712ae50861e3fa6d9cc98 - wtsapi32.dll f380bd95156fbfb93537f35941278778819df1629cb4c5a4e09fe17f6293b7b7 - wtsapi32.dll AshenLoader Variant #2 f9816bc81de2e8639482c877a8defcaed9b15ffdce12beaef1cff3fea95999d4 - srvcli.dll e71a292eafe0ca202f646af7027c17faaa969177818caf08569bd77838e93064 - srvcli.dll 739a5199add1d970ba22d69cc10b4c3a13b72136be6d45212429e8f0969af3dc - netutils.dll b00491dc178a3d4f320951bccb17eb85bfef23e718b4b94eb597c90b5b6e0ba2 - netutils.dll AshenStager 6bd3d05aef89cd03d6b49b20716775fe92f0cf8a3c2747094404ef98f96e9376 - wtsapi32.dll AshenOrchestrator 30490ba95c42cefcca1d0328ea740e61c26eaf606a98f68d26c4a519ce918c99 AshTag Module Designated as "SN" 66ab29d2d62548faeaeadaad9dd62818163175872703fda328bb1b4894f5e69e AES Keys and Nonce AshenLoader Variant #1 Key: {9a 20 51 98 4a 2b b1 76 ef 98 87 e3 be 87 f9 ca 44 ba 8c 19 a8 ef ba 55 62 98 e1 2a 39 21 ea 8b} Nonce: {44 ba 8c 19 a8 ef ba 55 62 98 e1 2a 39 21 ea 8b} AshenLoader Variant #2 Key: {60 3d eb 10 15 ca 71 be 2b 73 ae f0 85 7d 77 81 1f 35 2c 07 3b 61 08 d7 2d 98 10 a3 09 14 df f4} (generic default key) Nonce: {f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff} (generic default nonce) AshenStager XOR Key: msasn1.dll C2 Domains Backdoor forum.techtg[.]com forum.technoforts[.]com Exfiltration Server api.technology-system[.]com Loaders Variant #1 api.healthylifefeed[.]com api.softmatictech[.]com apiv2.onlinefieldtech[.]com auth.onlinefieldtech[.]com status.techupinfo[.]com api.medicinefinders[.]com account.techupinfo[.]com Loaders Variant #2 api.systemsync[.]info api.widetechno[.]info Scheduled Task Names C:\Windows\System32\Tasks\Windows\WindowsDefenderUpdate\Windows Defender Updater C:\Windows\System32\Tasks\Windows\WindowsServicesUpdate\Windows Services Updater C:\Windows\System32\Tasks\Automatic Windows Update Our assessment utilizes the Unit 42 Attribution Framework, which provides a systematic, evidence-based methodology to connect observed malicious activity to specific threat groups. This approach moves beyond subjective assessments, allowing us to rigorously evaluate multiple dimensions of threat data, including TTPs, tooling, OpSec, network infrastructure and victimology. There is a significant overlap between this campaign and Ashen Lepus’s established modus operandi. The group consistently crafts lures written in Arabic that focus on the developing political and military situation in the Middle East, with a specific emphasis on the Palestinian Territories. While public reporting on the group's post-compromise activity is limited, the hands-on espionage actions observed in this incident – specifically, the targeted theft of diplomatic documents – strongly correlate with the group's known intelligence collection interests and sophistication level. We identified clear infrastructure overlaps with historic reporting on the group. Specifically, the URL structure observed in this campaign aligns with findings from Check Point. For example, the URL cited in their report has the same subdomain naming scheme and URL parameter structure that we observed in previous loader versions (api/v1.0/account?token=): hxxps://support-api[.]financecovers[.]com/api/v1.0/account?token={encrypted_recon_data} A similar URL was also documented in OWN Security's report: hxxps://cdn[.]techpointinfo[.]com/api/v1.0/account?token={encrypted_recon_data} Malware Artifacts Analysis of the loader reveals key features consistent with previous campaigns from this group, as documented by Check Point. Notably, the loader continues to embed next-stage payloads within HTML tags of seemingly benign webpages and utilizes similarly structured execution lures to initiate the infection chain. The group also uses the same file names for their payloads – both their SharpStage .NET backdoor and previous versions of their loader were named wtsapi32.dll. AshenLoader is a possible evolution of the group's previous IronWind loader. Throughout 2025, Ashen Lepus was actively tweaking AshenLoader, which for the most part retained the same functionality. In addition to AshenLoader’s ability to communicate to the C2 server to download and execute additional payloads, the following features were updated: Encryption algorithm: The threat actors implemented an AES-CTR-256 cipher in versions of the malware that they compiled from early to late 2025, in contrast to the TEA algorithm mentioned in previous research. In samples that were compiled from mid to late 2025, the actors modified the encryption key and counter value (nonce) values. In both variants, the nonce and AES keys are hardcoded into the binaries. Fingerprinting additional data from infected endpoints: The new variants provide the threat actors with more detailed information about the infected endpoint than previous versions – such as listing files under the ProgramFiles directory. URI updates: Variants discussed in previous public research used the token parameter sent in the initial beaconing GET request. The earlier 2025 variants shifted toward using id= and q= parameters. Late 2025 variants then changed the scheme again and started using auth=. Additionally, part of the URI changed from /v1/ to /v2/. Although these features do not significantly change the loader’s functionality, they are simple and effective ways to avoid static detection engines. Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity – Check Point Molerats in the Cloud: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign [PDF] – Cybereason WIRTE Threat Group Card – Electronic Transactions Development Agency (ETDA) WIRTE : à la recherche du temps perdu – OWN CERT TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities – Proofpoint Updated Dec. 11, 2025 at 4:21 a.m. PT to remove a sentence about Turkish entities for clarification.