Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite

Ashen Lepus, a Hamas-affiliated threat group, has developed a new malware suite named AshTag targeting governmental and diplomatic entities primarily in the Middle East, with recent expansion to Oman and Morocco. The malware employs a sophisticated multi-stage infection chain using decoy PDFs and RAR archives to deliver payloads. AshTag features enhanced custom payload encryption, infrastructure obfuscation, and in-memory execution to evade detection. The group updated its command and control (C2) infrastructure to blend with legitimate traffic, complicating network defense efforts. This espionage campaign focuses on intelligence gathering from diplomatic and governmental targets. Although no known exploits are reported in the wild, the malware leverages multiple advanced techniques including process injection, persistence mechanisms, and credential harvesting. The threat poses a medium severity risk due to its targeted nature, complexity, and potential impact on confidentiality and integrity of sensitive information. European organizations with diplomatic ties or interests in the Middle East should be vigilant, especially in countries with strategic geopolitical connections to the region. Mitigation requires tailored detection of multi-stage infection vectors, enhanced network traffic analysis for C2 anomalies, and strict email attachment policies. Countries like France, Germany, and the UK are more likely to be affected due to their diplomatic presence and intelligence interests in the Middle East.

• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01
• Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMalware2026-09-30
• Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideMalware2026-08-13
• Project CAV3RN uses Google Apps Script for stealthy C2 in IsraelMalware2026-08-11
• HollowGraph Malware Uses Microsoft 365 Calendar Invites for Covert Command-and-ControlAnalysis2026-07-22