Hamas-Linked Hackers Probe Middle Eastern Diplomats

Hamas-affiliated hackers have been conducting espionage across the Middle East, with Unit 42 researchers noting that the group has evolved from simple tools to a fully formed malware suite. According to Palo Alto Networks’ Unit 42, the threat group is tracked as “Ashen Lepus” and has targeted regional government bodies and diplomatic entities since 2018, expanding in recent times to Oman and Morocco.

The researchers describe a new malware suite, named AshTag, which includes a loader, a stager, and a backdoor, designed with stealth in mind and capable of adding modules for extended access. The infection chain begins with phishing PDFs that lead to a file-sharing service hosting a RAR archive, triggering a DLL sideloading attack while remaining quietly active in the background.

Wirte’s loaders embed payloads in HTML, and the backdoor downloads modules by reading commented-out HTML tags, with payloads also encrypted and periodically updated to evade detection.