Loading story…
Check Point Research reported on The Eye on the Nile, an espionage campaign targeting organizations in the Middle East, with activity linked to surveillance and intelligence collection against regional victims. The operation was presented as a coordinated intrusion set focused on harvesting sensitive information from selected targets rather than causing disruptive or destructive effects.
The report described a threat actor using tailored malware and targeted delivery methods to compromise victims and maintain access for data collection. The campaign highlighted the continued use of regionally focused cyber-espionage operations against government and other strategic entities, underscoring the risk posed by persistent actors seeking long-term visibility into victim networks and communications.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published a report titled 'The Eye on the Nile,' documenting the campaign and its findings. No earlier event details are provided in the reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported a targeted espionage campaign in North Africa, primarily against Libyan organizations, using a previously undocumented modular Windows backdoor dubbed **Stealth Soldier**. The malware was built for surveillance and theft, with capabilities including file exfiltration, screenshot capture, microphone recording, keystroke logging, browser credential theft, and PowerShell-based command execution. Researchers observed several versions of the malware, from Version 6 compiled in October 2022 through Version 9 likely delivered in February 2023, indicating the operation remained under active development. The intrusion chain used a downloader, loader, watchdog, and final payload, while command-and-control and delivery infrastructure included domains such as `filestoragehub[.]live`, `customjvupdate[.]live`, and `filecloud[.]store`. Check Point said the infrastructure and phishing-domain naming patterns overlap with the earlier **Eye on the Nile** activity, suggesting the return of the same threat actor or a closely related cluster. The broader infrastructure also included phishing domains impersonating the Libyan Ministry of Foreign Affairs and webmail or login portals, aligning the campaign with politically motivated surveillance activity seen in prior phishing operations against civil society targets in the region, including Egyptian organizations documented by Amnesty International.
Aug 14, 2026
Italian investigators tied the **EyePyramid** cyber-espionage operation to Giulio Occhionero and Francesca Maria Occhionero after uncovering a long-running spear-phishing campaign that compromised prominent figures across Italy’s political, financial, legal, academic, religious, and institutional sectors. Authorities reported more than 100 active victims on the malware server and indications that roughly 16,000 people may have been targeted over several years, with command-and-control evidence placing activity from at least 2014 to 2016 and possible malware development dating back to 2008. The operation reportedly stole tens of gigabytes of data by sending malicious attachments in low-sophistication phishing emails and harvesting files from infected systems. Technical analysis showed EyePyramid was a **.NET** implant protected with heavy obfuscation and anti-debugging and anti-virtual-machine checks, while maintaining persistence through `Run` and `RunOnce` registry keys. The malware attempted to weaken host defenses by altering firewall rules, changing folder permissions, disabling UAC, and interfering with security tools, then encrypted strings and exfiltrated data with **3DES** using host-dependent keys. Stolen data was sent mainly through **SMTP** and **IMAP** attachments, with additional **WebDAV** and **HTTP** support, and the implant could authenticate to command-and-control servers to download files while also containing code related to **Active Directory** and **LDAP** privilege operations.
Aug 15, 2026
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026