APT Groups Weaponize Infostealer Malware in Precision Attacks

The piece describes a shift in cyber espionage where APT groups are weaponising opportunistic infostealer malware for targeted campaigns against diplomatic institutions. Recent threat intelligence from Hudson Rock’s Cavalier platform has exposed a pattern of infostealer infections compromising Ministry of Foreign Affairs credentials across multiple nations, affecting diplomatic infrastructure from Saudi Arabia to South Korea, the United Arab Emirates, Qatar and Oman.

In one notable case, a sophisticated spear-phishing campaign in August 2025 leveraged a compromised Omani Ministry of Foreign Affairs email account to distribute malware disguised as diplomatic communications, targeting more than 195 global recipients including the United Nations and the World Bank; the attackers are believed to be Iranian-aligned groups including Homeland Justice or MOIS.

The operation used stolen credentials from Oman’s Paris embassy and employed a Word document with VBA macros to deploy a data-collection malware, establishing C2 communications through a Jordanian NordVPN node. An earlier May 2025 incident in Turkey resulted in credentials from a Counter Terrorism Department email being used to funnel WmRAT, compromising PTCL’s telecommunications infrastructure, reportedly highlighting the credibility these authentic credentials lend to such campaigns.