WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage Backdoor

WIRTE, a threat actor described as an advanced persistent threat, has been linked to attacks on government and diplomatic entities in the Middle East, using a previously undocumented malware suite called AshTag. According to Palo Alto Networks, the activity cluster is tracked as Ashen Lepus, with evidence suggesting an expansion of targets to Oman and Morocco, beyond a broader footprint in the Palestinian Authority, Jordan, Iraq, Saudi Arabia and Egypt.

The operation begins with a harmless PDF decoy that lures victims into downloading a RAR archive, after which a renamed benign binary sideloads a malicious DLL named AshenLoader, which then contacts an external server to drop two more components: a legitimate executable and a DLL payload called AshenStager (aka stagerx64), also sideloaded to run the malware in memory.

AshTag is a modular .NET backdoor designed for persistence and remote command execution, masquerading as a VisualServer utility and leveraging an AshenOrchestrator to coordinate payloads in memory. In terms of capabilities, the payloads support persistence and process management, update and removal, screen capture, file exploration, and system fingerprinting, with Unit 42 noting hands-on data theft in one case.

Ashen Lepus has remained persistently active through the recent regional conflict, continuing operations and adapting its malware variants, according to the report.