Hamas-Linked Hackers Probe Middle Eastern Diplomats

Unit 42 documents a Hamas-affiliated APT (Wirte / Ashen Lepus) conducting persistent espionage across Middle Eastern governmental and diplomatic targets since 2018; the group has developed a modular malware suite named AshTag that uses phishing PDFs, DLL sideloading, HTML-embedded and commented-out payload storage, and strong encryption to evade detection, and has recently expanded its geographic scope and lure themes, indicating a broader operational footprint and sustained threat.