Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New Ash Tag Malware Suite
Summary: Unit 42 attributes a long-running espionage campaign against Middle Eastern government and diplomatic entities with high confidence to Ashen Lepus, also known as WIRTE, a Hamas-affiliated group active since 2018. The group has deployed a new modular .NET malware suite called AshTag, moved its command and control onto API and authentication subdomains of legitimate domains, and expanded targeting to Oman and Morocco.
What's compelling: After infection, the actors downloaded documents directly from a victim's mail accounts and exfiltrated them with the open-source tool Rclone, the first time this group has been seen doing so. The group stayed active through the Israel-Hamas conflict and after the October 2025 Gaza ceasefire, while other affiliated groups' activity declined.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026