Hamas-Affiliated APT Ashen Lepus Unveils AshTag Malware Suite for Wider Cyber-Espionage

According to Unit 42, Ashen Lepus (also known as WIRTE), a Hamas-affiliated APT, has upgraded its cyber‑espionage toolkit with a modular .NET malware suite named AshTag. The report notes that AshTag employs custom payload encryption and in‑memory execution to minimise forensic footprints, marking a significant evolution from earlier campaigns.

The infection chain features a lure of PDF decoys, a loader that side-loads AshenLoader to reveal the decoy PDF, and a stager that pulls the final payload from hidden HTML on a compromised site, with the orchestrator managing plugins entirely in memory. Researchers observed the group broadening its operational scope to entities in other Arabic-speaking nations, including Oman and Morocco, while maintaining a focus on diplomacy‑related documents.

Exfiltration activities include manually downloading documents from victims’ mail accounts and using Rclone, a legitimate cloud storage tool, to smuggle data out. The findings come from a December 2025 report highlighting how Ashen Lepus continues to adapt its TTPs during the Israel-Hamas conflict.