Hamas-affiliated APT targeting government agencies in the Middle East, Morocco

Palo Alto Networks Unit 42 reports that an alleged Hamas‑affiliated group called Ashen Lepus has deployed a malware suite named AshTag via malicious PDF decoys and RAR archives to breach government and diplomatic targets in Oman, Morocco and the Palestinian territories, exfiltrate sensitive documents, and conduct hands‑on‑keyboard intelligence collection; the group shows increasing sophistication and remained active after the October 2025 ceasefire.