Hackers Target Middle East Governments with Evasive "CR4T" Backdoor

Kaspersky uncovered a targeted cyber-espionage campaign named DuneQuixote that has been delivering a backdoor called CR4T to Middle Eastern government entities via droppers (including a trojanized Total Commander installer). The campaign uses novel C2-decryption (MD5 derived from filename plus embedded Spanish-poem snippets), strong anti-analysis checks, memory-only implants, and a Golang variant that supports COM object hijacking for persistence and Telegram-based C2, indicating a capable, actively evolving threat actor.