Loading story…
Threat actors have launched a sophisticated campaign, dubbed Operation IconCat, targeting Israeli organizations across sectors such as information technology, staffing services, and software development. The attackers use weaponized Word and PDF documents that impersonate trusted antivirus vendors like Check Point and SentinelOne, leveraging social engineering to bypass security defenses. Victims are lured into opening these documents, which then deliver malware payloads, including a Python-based implant called PYTRIC and a Rust-based implant named RUSTRIC. The campaign employs two main infection chains: one using PDF files as decoys to distribute malware via Dropbox, and another using malicious Word documents with embedded code. Both chains exploit AV icon spoofing to increase credibility and user interaction.
Researchers at Seqrite Labs have identified that the threat cluster, tracked as UNG0801, is likely based in Western Asia and demonstrates a persistent focus on Israeli enterprise environments. The phishing lures are crafted in Hebrew and mimic routine internal communications, such as compliance updates and security advisories. The campaign's technical sophistication includes the use of PyInstaller for packaging malware, system-wide file scanning, privilege escalation checks, and destructive capabilities like system erasure. Indicators of compromise and MITRE ATT&CK mappings have been published to aid defenders in detection and response efforts.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Seqrite Labs published its research on UNG0801/Operation IconCat, linking the two campaigns through shared tactics, techniques, infrastructure, and timing despite their differing goals of espionage and destruction. The company also released detection signatures and indicators of compromise for both malware delivery chains.
In a parallel campaign, spear-phishing emails impersonating legitimate Israeli companies delivered macro-enabled Word documents that installed the Rust-based RUSTRIC implant. RUSTRIC performed host and network reconnaissance, enumerated 28 AV/EDR products, and communicated with attacker-controlled command-and-control servers.
In one campaign, attackers used malicious PDF files themed around trusted AV vendors such as Check Point and SentinelOne to deliver a PyInstaller-packed Python wiper dubbed PYTRIC. The malware was designed for destructive impact, including wiping system data, and used Dropbox plus Telegram-based or custom infrastructure for delivery and control.
Seqrite Labs said the threat cluster it tracks as UNG0801, also called Operation IconCat, began two related campaigns against Israeli organizations in November 2025. The activity targeted sectors including IT, HR, and software development using Hebrew-language phishing lures and spoofed antivirus branding.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and media reports said the Hamas-linked threat group **APT-C-23** targeted high-ranking Israeli officials in a spear-phishing campaign designed to steal sensitive information from government and security figures. The operation, dubbed **Operation Bearded Barbie** by Cybereason, used social-engineering lures and fake personas to build trust with targets before delivering malware and harvesting data from compromised devices. The campaign was attributed to a Palestinian cyber-espionage actor also tracked as **Arid Viper**, with reporting indicating the activity focused on Israeli public-sector and political targets. The operation combined tailored phishing messages, fraudulent online identities, and mobile-focused surveillance tooling to gain persistent access and collect intelligence, underscoring the group’s continued use of espionage tactics aligned with regional geopolitical interests.
Aug 14, 2026
A sophisticated spearphishing campaign, identified as PhantomCaptcha, targeted key organizations involved in Ukraine's war relief efforts, including the International Committee of the Red Cross (ICRC), UNICEF, the Norwegian Refugee Council, and various Ukrainian regional government administrations. The attackers impersonated the Ukrainian President’s Office, sending emails with weaponized PDF attachments designed to lure recipients into clicking malicious links. These links led to a fake Cloudflare captcha page, which was actually a 'ClickFix'-style decoy, ultimately delivering a multi-stage WebSocket-based remote access trojan (RAT). The infrastructure supporting this campaign was hosted on Russian-owned servers and was only active for a single day, indicating a high level of operational security and planning, with evidence suggesting at least six months of preparation. The campaign’s technical sophistication included the use of a convincing eight-page document and a redirection to a domain masquerading as a legitimate Zoom website, further enhancing the credibility of the phishing attempt. Once the RAT was deployed, it enabled the attackers to execute arbitrary remote commands, exfiltrate sensitive data, and potentially deploy additional malware on compromised systems. Investigators also discovered a mobile attack vector, with fake Android applications designed to harvest geolocation data, contacts, media files, and other sensitive information from targeted devices. The selection of targets suggests the attackers were seeking intelligence on humanitarian operations, reconstruction planning, and international coordination related to Ukraine. Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions were specifically named among the targets. The campaign’s rapid disappearance after a single day of activity points to a deliberate effort to avoid detection and forensic analysis. SentinelLabs, in collaboration with the Digital Security Lab of Ukraine, led the investigation and public disclosure of the campaign. The use of Russian infrastructure and the focus on Ukrainian and international relief organizations suggest a possible geopolitical motivation, though attribution remains unconfirmed. The attack chain was designed to bypass traditional security controls by exploiting trust in official communications and leveraging multi-stage payload delivery. The campaign highlights the ongoing threat to humanitarian and governmental organizations operating in conflict zones, particularly those involved in Ukraine. Security researchers emphasize the need for heightened vigilance and advanced detection capabilities to counter such highly targeted and transient threats. The incident underscores the importance of cross-organizational intelligence sharing and rapid response to emerging spearphishing campaigns. Organizations are advised to review their email security protocols, educate staff on phishing risks, and monitor for indicators of compromise associated with the PhantomCaptcha infrastructure.
Jun 29, 2026
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026