Loading story…
A spearphishing campaign compromised at least 15 Israeli defense-related computers after targets received a spoofed email posing as a message from Israel's Shin Bet security service. The lure referenced the death of former Prime Minister Ariel Sharon and carried a malicious attachment that installed Xtreme RAT, giving attackers temporary remote control, the ability to execute commands, steal information, and potentially spread further inside affected networks.
Researchers at Seculert said one confirmed victim was Israel's Civil Administration, the agency that manages Palestinian movement and entry permits, while other affected systems were reported to belong to suppliers connected to the Israeli defense forces. The company said it disrupted the operation by sinkholing the malware, but the full scope of data access and lateral movement was not publicly confirmed. Investigators said the campaign resembled a 2012 attack on Israeli government targets, with some assessments pointing to likely pro-Palestinian hackers, though attribution remained unconfirmed.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
By 2014-01-27, Seculert publicly reported the intrusion, describing technical and stylistic similarities to a 2012 attack against Israeli government staff and assessing that pro-Palestinian hackers were likely responsible. Attribution remained unconfirmed, and Israeli officials did not publicly comment.
During its investigation, Israeli security firm Seculert said it disrupted the attack by sinkholing the malware infrastructure, helping contain the threat. The full extent of data theft, lateral movement, or operational impact was still unclear.
In mid-January 2014, the phishing campaign temporarily compromised 15 computers linked to Israel's defense sector. One confirmed victim was Israel's Civil Administration, and other affected systems were reportedly tied to suppliers to the Israeli defense forces.
On 2014-01-15, attackers launched a spearphishing campaign using emails disguised as messages from Israel's Shin Bet security service and themed around the death of former Prime Minister Ariel Sharon. The malicious attachment delivered Xtreme RAT to targeted defense-related systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and media reports said the Hamas-linked threat group **APT-C-23** targeted high-ranking Israeli officials in a spear-phishing campaign designed to steal sensitive information from government and security figures. The operation, dubbed **Operation Bearded Barbie** by Cybereason, used social-engineering lures and fake personas to build trust with targets before delivering malware and harvesting data from compromised devices. The campaign was attributed to a Palestinian cyber-espionage actor also tracked as **Arid Viper**, with reporting indicating the activity focused on Israeli public-sector and political targets. The operation combined tailored phishing messages, fraudulent online identities, and mobile-focused surveillance tooling to gain persistent access and collect intelligence, underscoring the group’s continued use of espionage tactics aligned with regional geopolitical interests.
Aug 14, 2026
Employees at **Ashot Ashkelon Industries Limited**, a subsidiary of Israel Military Industries, were targeted in a spear-phishing campaign that used a Hebrew-language lure posing as a **SysAid** software update. The email carried a malicious archive, `SysAid-Documentation.rar`, which exploited the WinRAR ACE path traversal flaw **`CVE-2018-20250`** to place malware in the Windows Startup folder and gain persistence. Researchers linked the operation to a Lazarus-associated cluster and said the primary payload, `ekrnview.exe`, gathered host information and sent it to hardcoded command-and-control servers through HTTP POST fields including `alive`, `name`, `key`, `page`, and `session_data`. The investigation also uncovered attacker infrastructure and related samples suggesting broader Middle East targeting. One exposed command-and-control server hosted a **B374k** webshell, while shortcut and working-directory artifacts pointed to tailored targeting and operator development traces such as the usernames `john` and `Albany`. Separate samples tied to the same **`CVE-2018-20250`** exploitation chain dropped a fake `Telegram Desktop.exe` and a Base64-encoded .NET payload, overlapping with activity tracked by **360** as **APT-C-27 (Goldmouse)** and indicating a wider campaign using WinRAR exploit lures against regional defense-related targets.
Aug 15, 2026
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026