Delphi Used To Score Against Palestine
Summary: Cisco Talos analyzed a Delphi-written spear-phishing campaign that delivered the MICROPSIA remote administration tool through RAR archives disguised with a .r10 extension and executables named to look like PDFs and Word documents. The decoys included stolen Palestinian government and research documents and a banned Lebanese music video, and Talos believes more than 500 systems are already registered on the command-and-control server at camilleoconnell[.]website.
Why it matters: More than 500 registered systems may include researcher sandboxes, but the campaign's use of genuine stolen documents and a banned video as lures shows the decoys were built to be opened, not just delivered. The malware's hardcoded Googlebot user-agent and TV-show-themed URL paths mean standard network signatures keyed to obvious malicious traffic may not flag it.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026