CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

WIRTE Deploys AshTag Espionage Backdoor via AshenLoader Sideloading

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The advanced persistent threat (APT) group WIRTE, also tracked as Ashen Lepus, has been targeting government and diplomatic entities in the Middle East since 2020 with a previously undocumented malware suite called AshTag. The group leverages AshenLoader for sideloading to deploy the AshTag backdoor, which facilitates espionage and data theft. Recent attacks have expanded to include Oman and Morocco, with a focus on geopolitical lures related to Turkey and Palestine. The campaign involves phishing emails, PDF decoys, and a multi-stage infection process to minimize forensic artifacts. The AshTag backdoor is modular and designed for persistence, remote command execution, and data exfiltration. The group's activities have remained persistent throughout regional conflicts, unlike other affiliated threat groups. The threat actors have been observed conducting hands-on data theft, staging documents of interest in the C:\Users\Public folder before exfiltrating them to an attacker-controlled server.

Timeline

  1. 11.12.2025 13:00 1 articles · 3h ago

    WIRTE Expands Operations to Oman and Morocco with AshTag Backdoor

    The WIRTE group, also known as Ashen Lepus, has been targeting government and diplomatic entities in the Middle East since 2020 with the AshTag backdoor. The group's operations have expanded to include Oman and Morocco, with a focus on geopolitical lures related to Turkey and Palestine. The AshTag backdoor is a modular .NET backdoor designed for persistence, remote command execution, and data exfiltration. The group's activities have remained persistent throughout regional conflicts, unlike other affiliated threat groups. The threat actors have been observed conducting hands-on data theft, staging documents of interest in the C:\Users\Public folder before exfiltrating them to an attacker-controlled server.

    Show sources
    Open in new tab

Information Snippets