Tag: WIRTE threat group

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities

Posted on

In mid-2023, Proofpoint researchers first identified TA402 (Molerats, Gaza Cybergang, Frankenstein, WIRTE) activity using a labyrinthine infection chain to target Middle Eastern governments with a new initial access downloader Proofpoint has dubbed IronWind. From July through October 2023, TA402 utilized Read More …

WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019

Posted on

This February, during our hunting efforts for threat actors using VBS/VBA implants, Kaspersky researchers came across MS Excel droppers that use hidden spreadsheets and VBA macros to drop their first stage implant. The implant itself is a VBS script with Read More …