SecuriTricks - middle east

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

An internal leak from APT35 (Charming Kitten) reveals a sophisticated, state-directed cyber-intelligence operation targeting diplomatic, government, and corporate networks in the Middle East and Asia. The documents expose a bureaucratic structure with defined workflows, performance metrics, and spe…

phishing

iran

cyberespionage

proxyshell

middle east

intelligence collection

Published: November 22, 2025

Downloadable IOCs: 1

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and mili…

Published: September 30, 2025

Downloadable IOCs: 4

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction tec…

Published: August 12, 2025

Downloadable IOCs: 0

Forges Recruitment Sites, Launches Attacks on Aerospace and Semiconductor Industries in Multiple Countries

In this analysis, researchers have uncovered a malicious campaign orchestrated by APT35, a threat group believed to be affiliated with the Islamic Revolutionary Guard Corps (IRGC) of Iran. The group has been observed using forged recruitment sites and corporate sites to target the aerospace and sem…

semiconductor industry

Published: December 4, 2024

Downloadable IOCs: 12

Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity

Check Point Research has been tracking ongoing activity of the WIRTE threat actor, associated with Hamas, despite the ongoing conflict in the region. The group continues to target entities in the Palestinian Authority, Jordan, Iraq, Egypt, and Saudi Arabia for espionage. WIRTE has expanded its oper…

Published: November 12, 2024

Downloadable IOCs: 90

Tag: middle east

Attack reports

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

Forges Recruitment Sites, Launches Attacks on Aerospace and Semiconductor Industries in Multiple Countries

Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity