Targeted Attacks In The Middle East
Summary: Cisco Talos documented targeted Middle East campaigns using decoy documents - a purported Dar El-Jaleel analysis of Iranian activity in the Syrian civil war, a weekly regional events report, and a June 2017 military pension list - to deliver .NET, C++ and VBS malware that performed reconnaissance and downloaded further payloads. The VBS chain registered infected systems to office-update[.]services, polled a /search URI every 5 seconds, collected volume serial numbers, antivirus software, public IP and system details, and ultimately attempted to map and execute shellcode from 176[.]107[.]185[.]246, with the attacker using CloudFlare, user-agent filtering and firewall rules to serve payloads only briefly.
Bottom line: The attacker blocked Talos's own User-Agent strings and IP addresses and made the shellcode server unreachable after minutes - OPSEC Talos called exceptional even among presumed state-sponsored actors, meaning your detection window against this infrastructure may be equally short.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026