EAGERBEE, with updated and novel components, targets the Middle East

This report analyzes the EAGERBEE memory-resident backdoor and associated components — a Themes-targeting service injector, a Plugin Orchestrator DLL, and multiple plugins providing file system manipulation, remote access, process and service management, and network enumeration. It documents active deployments against ISPs and government entities (Middle East and East Asia), shows use of ProxyLogon-based Exchange compromises and service DLL hijacking to load loaders and payloads, provides IoCs (hashes, IPs, domains), and assesses a medium-confidence link to the CoughingDown group.