WIRTE: Iran’s Covert Espionage Actor Targeting the Middle East and Beyond

WIRTE ("Ashen Lepus") is a Gaza-aligned APT conducting long-running regional espionage against Middle Eastern government, military, and diplomatic targets using spearphishing with malicious Office macros, PowerShell-based modular implants (e.g., LitePower, Ferocious), and cloud-based HTTPS/DNS C2 to maintain stealthy persistence and exfiltrate sensitive data; the group focuses on intelligence collection to support Hamas-aligned objectives and has evolved operationally since 2018.