Middle East Conflict Triggers Spike in State-Linked Espionage and Malware Campaigns

Escalating conflict following Operation Epic Fury (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned TA453 (Charming Kitten / Mint Sandstorm / APT42) continued intelligence collection during the conflict, including a credential-phishing attempt against a US think tank observed on 8 March, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to China, Belarus, Pakistan, and Hamas). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing.

Check Point Research separately identified China-linked activity targeting Qatar, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including PlugX and Cobalt Strike, with tradecraft described as a multi-stage chain involving a compromised server and DLL hijacking via a legitimate application (Baidu NetDisk) to load the backdoor—highlighting rapid weaponization of breaking news to target energy and military sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking ‘BlackSanta’ BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).