Ashen Lepus Hacker Group Attacks Eastern Diplomatic Entities With New AshTag Malware

A Palo Alto Networks–sourced report describes an ongoing espionage campaign by Hamas‑affiliated Ashen Lepus using Arabic diplomatic lures to deliver a modular .NET backdoor called AshTag; attackers employ benign‑looking PDFs and RAR archives (fake executables and decoy PDFs), DLL sideloading, in‑memory payload execution, and API‑style subdomains for C2 to stealthily exfiltrate diplomatic documents and maintain persistent access across the region.