Eagerbee backdoor deployed against Middle Eastern govt orgs, ISPs

Eagerbee is a sophisticated persistent backdoor framework observed in targeted attacks against government organizations and ISPs in the Middle East (and cases in Japan), using a loader (tsvipsrv.dll -> ntusers0.dat -> dllloader1x64.dll) and DLL hijacking to run a plugin-based backdoor (file, process, remote access, service, network managers); Kaspersky links it to the CoughingDown group and notes past use of the Exchange ProxyLogon vulnerability (CVE-2021-26855), advising patching and use of provided IoCs.