Skip to content

CyberSIXT Search

Threat actor

Ashen Lepus

Palestine

Tracked by CyberSIXT since 11 Dec 2025

Articles · all time: 3
Articles · last 30 days: 0
CVEs exploited · attributed · all time: 0
Research reports · all time: 1

Three articles so far, 11 Dec 2025 to 15 Dec 2025.

Thu 11 Dec 2025 · first reportHamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware SuiteUnit 42
Thu 11 Dec 2025WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage BackdoorThe Hacker News
Mon 15 Dec 2025Hamas-Affiliated APT Ashen Lepus Unveils AshTag Malware Suite for Wider Cyber-EspionageSecurityOnline

See the full timeline

Names and sources

WIRTE: Named by CyberSIXT coverage
Ashen Lepus: Named by Malpedia · wirte
WIRTE: Named by Malpedia · wirte
Ashen Lepus: Named by MISP Galaxy · ec6bcaa9-4cb3-4397-a735-c806bc986c81
WIRTE: Named by MISP Galaxy · ec6bcaa9-4cb3-4397-a735-c806bc986c81
Ashen Lepus: Named by MITRE ATT&CK® · G0090
WIRTE: Named by MITRE ATT&CK® · G0090
ec6bcaa9-4cb3-4397-a735-c806bc986c81: Named by CyberSIXT coverage

Attributed facts

origin: Palestine (MISP Galaxy · ec6bcaa9-4cb3-4397-a735-c806bc986c81)

Malware and tools

Empire (MITRE ATT&CK® · G0090) Ferocious (MITRE ATT&CK® · G0090) LitePower (MITRE ATT&CK® · G0090) Rclone (MITRE ATT&CK® · G0090) Havoc (MITRE ATT&CK® · G0090) IronWind (MITRE ATT&CK® · G0090) SameCoin (MITRE ATT&CK® · G0090) AshTag (MITRE ATT&CK® · G0090) Ashen (Malpedia · wirte)

MITRE ATT&CK® techniques

From MITRE ATT&CK® · G0090

Tactics pending refresh

T1027.010: Command Obfuscation
T1027.015: Compression
T1036.005: Match Legitimate Resource Name or Location
T1041: Exfiltration Over C2 Channel
T1059.001: PowerShell
T1059.003: Windows Command Shell
T1059.005: Visual Basic
T1071.001: Web Protocols
T1074.001: Local Data Staging
T1105: Ingress Tool Transfer
T1106: Native API
T1114.001: Local Email Collection

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Coverage

3 articles, all timeFull timeline RSS feed

15 Dec 2025Hamas-Affiliated APT Ashen Lepus Unveils AshTag Malware Suite for Wider Cyber-EspionageSecurityOnline
11 Dec 2025WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage BackdoorThe Hacker News
11 Dec 2025Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware SuiteUnit 42 · first in our coverage

Research reports

Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive ActivityOrkl.eu · 12 Apr

Learn more