“Operation IconCat”: Hackers Masquerade as Security Giants to Target Israeli Firms

A new cyber-espionage campaign named “Operation IconCat” targets Israeli organisations by disguising malicious implants as trusted antivirus updates and spoofing branding from major security vendors. The activity is linked to a threat cluster tracked as Unknown-Clusters (UNG0801), which SEQRITE Labs’ APT Team says has used two distinct waves—PYTRIC, which leverages the Check Point brand to deliver a destructive implant, and RUSTRIC, which mimics SentinelOne to carry out espionage.

Researchers note a heavy reliance on antivirus icon spoofing to create a false sense of legitimacy, with Hebrew phishing emails that imitate routine internal communications steering victims to open Word or PDF documents. The campaigns reportedly run a single playbook for abusing AV icons, and have involved signed malware using digital certificates tied to the domain netvigil[.]org, as observed in certificate history on Censys.

Attribution remains elusive, but SEQRITE Labs’ assessment points to Western Asia, with organisations in the region urged to scrutinise security updates arriving by email, even when icons appear familiar. December 2025 marks the period when the investigation began in the third week of November 2025.