Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite

Unit 42 reports that Ashen Lepus, a Hamas-affiliated threat group, is targeting Middle Eastern diplomatic entities with a new malware suite named AshTag. The campaign features a multi-stage infection chain starting with a decoy PDF that leads to a RAR archive, then through loaders and stagers embedded in HTML tags to deliver AshTag, a modular .NET backdoor designed for in-memory payload execution and remote command execution.

AshTag relies on a revised C2 architecture that uses subdomains of legitimate domains to blend in with normal traffic, and it includes enhanced payload encryption, file exfiltration capabilities and a fingerprinting module, such as the SN module that collects endpoint data.

After initial compromise, Ashen Lepus conducts hands-on data theft, staging diplomacy-related documents in the C:\\Users\\Public folder and exfiltrating them using the open-source tool Rclone, marking a first observed use of Rclone by this group. The researchers attribute the activity with high confidence to Ashen Lepus, noting evolution in TTPs, infrastructure obfuscation and in-memory execution as part of the campaign’s security posture.

AshTag represents a notable upgrade in the group’s tooling and operational security as it expands its targeting footprint beyond traditional geographic confines.