Israeli Entities Targeted by Cyberattack Using Donut and Sliver Frameworks

Cybersecurity researchers detailed a targeted campaign dubbed 'Supposed Grasshopper' that uses realistic WordPress sites to deliver VHD files containing a Nim-based downloader; that downloader fetches Donut-generated shellcode from attacker infrastructure which is used to deploy the Sliver C2 framework. The activity leverages publicly available open-source tooling and dedicated infrastructure to target various Israeli entities, and the report also references a separate Excel-based Orcinius trojan infection chain.