WIRTE uses AshenLoader to install the AshTag Backdoor

An advanced persistent threat (APT) known as WIRTE has been attributed to attacks targeting government and diplomatic entities in the Middle East with a previously undisclosed malware suite called AshTag since 2020.

See also: MuddyWater targets Turkey-Israel-Azerbaijan with UDPGangster Backdoor

Palo Alto Networks is tracking the Ashen Lepus cluster of activities . Objects uploaded to VirusTotal show that the threat actor has focused on Oman and Morocco, indicating an expansion in its operational scope beyond the Palestinian Authority, Jordan, Iraq, Saudi Arabia, and Egypt.

WIRTE, which overlaps with an Arabic-speaking, politically motivated cluster known as the Gaza Cyber ​​Gang (also known as Blackstem, Extreme Jackal, Molerats, or TA402), is estimated to have been active since 2018. According to a report by Cybereason, both Molerats and APT-C-23 (also known as Arid Viper, Desert Varnish, or Renegade Jackal) are two main subgroups of Hamas' cyberwarfare division.

It is primarily driven by espionage and intelligence gathering, targeting government entities in the Middle East to achieve its strategic goals.

In a report published in November 2024, Check Point attributed the hacking group to destructive attacks targeting exclusively Israeli entities to infect them with a custom-made destructive malware referred to as SameCoin, highlighting their ability to adapt and perform both espionage and sabotage.

See also: CISA reports Chinese hackers using BRICKSTORM

The long-running, stealth campaign described by Unit 42, dating back to 2018, has been found to utilize phishing emails with baits related to geopolitical issues in the region. A recent increase in baits related to Turkey suggests that entities in the country may be a new area of ​​focus.

The attack chains begin with a harmless PDF decoy that tricks recipients into downloading a RAR file from a file sharing service. Opening the file triggers a chain of events that leads to the deployment of AshTag.

This involves using a renamed innocuous binary to sideload a malicious DLL called AshenLoader which, in addition to opening a decoy PDF file to perpetuate the scam, communicates with an external server to download two more components: a legitimate executable file and a payload DLL called AshenStager (also known as stagerx64) which again is loaded to launch the malware suite in memory to minimize forensic artifacts.

AshTag is a modular .NET backdoor designed to facilitate persistence and remote command execution while pretending to be a legitimate VisualServer tool to evade detection. Internally, its features are implemented through an AshenOrchestrator to enable communications and perform additional in-memory loads.

See also: Iranian hackers target Israel with MuddyViper backdoor

In one case, Unit 42 observed the threat actor gaining access to a compromised computer to conduct manual data theft , organizing documents of interest into the C:\Users\Public folder . These files are said to have been downloaded from the victim’s email inbox, with the ultimate goal of stealing diplomatic-related documents. The documents were then exported to a server controlled by the attacker using the Rclone tool.