ClearSky Cyber Security

ClearSky has identified renewed activity by the Russian influence campaign “Doppelgänger” targeting Israel. Between May and October 2026, we documented at least 76 fake articles on walla[.]ist, a site impersonating the Israeli news site Walla, amplified by networks of inauthentic X accounts. Since early October 2026, the campaign’s central redirect server has been a bare IP address, 89.124.67[.]27, rather than a domain fronted by Cloudflare as before. According to WHOIS records, the IP is allocated to VDSina (vdsina[.]com), a VPS provider registered in Dubai whose parent company, vdsina[.]ru, is based in Russia. We assess that this change likely followed Cloudflare’s termination of the campaign’s previous domain, forcing the operators onto infrastructure that exposes their hosting provider. The campaign’s narratives follow the news cycle. In May, the articles portrayed Hezbollah as using “Ukrainian drones.” Since August, they have portrayed Turkey as a greater threat to Israel than Iran, alongside claims that the US is abandoning Israel. Together, these two messages appear in 41 of the 76 headlines (54%). The full report is available on our blog: clearskysec.com/blog/

ClearSky is tracking a new VBScript-based RAT used in activity targeting the Ukrainian defense sector, with a lure themed around a Ukrainian robotics unit. We track it as "ServoRAT". The infection chain begins with a malicious Office document containing a macro, which retrieves the ServoRAT VBS payload from a GitHub repository. Currently, only two AV engines detect the VBS payload as malicious. ServoRAT uses Telegram as its C2 channel and contains three hardcoded Telegram bot tokens, allowing it to switch between them if one becomes unavailable. Key capabilities include: - Telegram-based C2 - Arbitrary PowerShell command execution - File upload, download, and directory exfiltration - Screenshot capture - Browser data collection - Telegram Desktop tdata collection - Persistence via the Startup folder, a Registry Run key, and a Scheduled Task - Firewall modification and TCP listener support Self-destruct functionality One notable behavior is its handling of Telegram Desktop data: ServoRAT collects the victim's "tdata directory", exfiltrates the archive, and then deletes the local copy. The malware uses the system BIOS serial number to identify infected hosts, allowing the operator to address commands to a specific machine or to all compromised systems. The lure suggests an effort to reach individuals or organizations connected to Ukraine's defense sector, using robotics-related content as the social-engineering theme. We observed Russian-language comments within the macro code. While this alone is not sufficient for attribution, taken together with the targeting context it may indicate a Russian state-aligned threat actor. IoC's: Sha256: 523f21fad7e3e8c4ffd9897b875c0df9609a825fd0c9d274319da132fa358cb9 2edb9dd4df9c8ebe605fd5807b94d472392ea95b0cb6a517b659d10192f83c80 Network: raw[.]githubusercontent[.]com/er782sdfsdf/123/main/Microsoft%20Excel[.]dll #CyberSecurity #ThreatIntel #Ukraine #Malware #ServoRAT #CTI

ClearSky identified connection between a malicious domain discovered by Checkpoint, A domain of an Israeli printing company, and an infrastructure related to the Iranian influence group: "The Punishment for Justice" . Initially, the pivot shown in the Maltego graph began with a subdomain google[.]com[.]hospitalinstallation[.]com. For-justice[.]org is part of an Iranian influence operation offering money to assassinate senior Israelis. Link to Israeli news media referring to this group: ynet.co.il/news/article/rj1z… IoCs: cdncloudedge[.]com clipeditskill[.]com 192[.]121.17.236 185[.]195.65.240 188[.]190.28.243 highmontgroup-ltd[.]com #ThreatIntel #OSINT #CyberSecurity #Iran #ThreatHunting #InfoSec

In its latest campaign, "Tortoiseshell", targeted multiple Israeli organizations. "Tortoiseshell" is an Iranian state-aligned espionage actor, estimated to operate under IRGC direction, active since 2017. Overlapping vendor names: Imperial Kitten, TA456, Crimson Sandstorm, Yellow Liderc, Curium. The following domains were compromised: • settlers[.]co[.]il • millerdeliveries[.]co[.]il Logging into millerdeliveries[.]co[.]il redirected victims to lionwheel[.]net, an impersonation of lionwheel[.]com, an Israeli delivery service. Upon visiting settlers[.]co[.]il, visitors are redirected to lovelyhub[.]vip, which hosts a phishing kit for Microsoft 365. IOC’s: hr-globalmhi[.]org apiasaservices[.]com sporttimes[.]online lionwheel[.]online lionwheel[.]net lovelyhub[.]vip israelichoice[.]com languatalk[.]net loginlovelyhub[.]net Moderate confidence: cdnbootstrap[.]online #Tortoiseshell #ThreatIntel #CTI #IranAPT

Recently, we detected activity attributed to the Iranian threat actor TA455, leveraging the "Dream Job" lure campaign. Malware impersonates a Zoom update and a fake United Airlines job interview. The threat actor uses a DLL side-loading technique and Azure cloud-based command-and-control infrastructure with a fallback mechanism to reduce detection. Our research revealed malware files with zero detections and we were able to extract the threat actor's C2 infrastructure. The malicious files were signed with two digital signatures: Kirubel Kerie Negeya Gray Matter Software S.R.L. Hashes (Sha1): 94a0fcc1fb22c6a96abfefbb75bc40afb126f69a 67f41dc48bfd0c0597295259bd3c0d3c09dfea34 a067d4a121af6922fd695e76fa5720135ed12e7b 58c83b743101ed77aea7fda7e3516903eaeda12d 62158039d0998363748942aae3169ccc0f67a641 f687b606e7bdd7533e327c98fecb71937564dc92 67d635eff6a477efb34de9150c1c2c8b2139e114 b07bbb006ddfcf5cc216937752b8a67e288a1ca1 6e12c54d1861a455c0008ed9ce166e843298a4a0 fca243db4f4671e6425c7813b24585c22137224f 491ac43610a46ad3a9ca647e6e7b29e6387b2169 3b2926400541e017a043926ebf92dd91ee80d797 da11679653ef33952c3dc8d8850e43d7b8ac884a 94a0fcc1fb22c6a96abfefbb75bc40afb126f69a Network: business-startup[.]org business-startup[.]azurewebsites[.]net ramiltonsfinance[.]azurewebsites[.]net ramiltons-finance[.]azurewebsites[.]net ramiltonsfinance[.]com buisness-centeral[.]azurewebsites[.]net buisness-centeral-transportation[.]azurewebsites[.]net buisness-centeral-transportation[.]com premierhealthadvisory[.]azurewebsites[.]net premier-healthadvisory[.]azurewebsites[.]net premierhealthadvisory[.]com

We discovered two sophisticated previously undocumented malware families targeting Ukraine: BadPaw (Loader) & MeowMeow (Backdoor). Key Evasion Tactics: * Sandbox/VM & anti-tooling checks * NetReactor protection * Requires a specific launch argument to run (otherwise deploys decoy code) We attribute this campaign with high confidence to Russia APT likely APT28. clearskysec.com/blog/ #ThreatIntel #Malware #Ukraine #CyberSecurity #APT

We recently discovered renewed activity from the Iranian-linked threat actor Ferocious Kitten, a group that had been off the radar for quite some time, in an attempt to capture Iranian freedom fighters and opposition figures. To trick victims into downloading the trojanized installer, the actor uses a fake media-player website, "YEMPlayer". By leveraging DLL side-loading, it loads a malicious payload and establishes C2 communication. Some of the Media Player extracted files are signed with digital signature by "Nikki Boy Semblante" IoCs: 13440348516ccee839675f6ac908dd1724ce1d28f92af92fdc7938740d2b7ec5 cc59bf019af195dcec4394ffd7a8e23c080f4e02b12dcb7c04fb1da6671922a1 fa246327bed8fc5864827a8147b8b7aedb6246068259b8c97e82adb957315347 51a6686b8c5ec7c610637398f3de43589f4e9fcbe8bcc0245343c5454d3b91de 66dcd98c6b310f4429890821e609d48cc6395a6be15ffe5a121ec68b7a8f7402 bb0c7ae4f12e5141480ee26f473636b07e836bb994ff3b2cfec93d4480da171b ea755862ee81dd0d991b4afca42d8b82bb22a8f1d370bf3d28dbf2e44ab241dd ea755862ee81dd0d991b4afca42d8b82bb22a8f1d370bf3d28dbf2e44ab241dd 6c74d29903bc2cc17ec4afdb1a120d2060209b22830cee2b7005f5436e86f90e comi-site[.]website come-site[.]website yemplayer[.]site comview[.]website come-signin[.]quest comisignin[.]online 212[.]83.61.198 #ThreatIntel #Iran #CyberSecurity #Malware #DLLSideLoading #C2 #APT

A new wiper attack has been identified by ClearSky Cyber Security affecting Ukraine. We named this wiper "GamaWiper" (VBS-based wiper). The intrusion chain begins with the exploitation of a vulnerable WinRAR version (CVE-2025-80880). We assess with moderate confidence that this activity is linked to the Gamaredon APT group. This marks the first observed instance of Gamaredon conducting destructive operations rather than its traditional espionage activities. Related IoCs: 95262c4094a9a5e589a218e354ef54b3800aa0abc3b6a343bbcfdcbf021fc04f – initial ZIP with vulnerability CVE-2025-80880 68e21d7599d20444232415a7e74214ce50d7b4643215d83b8320e74c95a9dfd3 – downloaded VBA aafa4c206495163a5e408aa5c296139fe9f330a9f819a226c6934921493de9c6 – downloaded (padded+base64) wiper d4ce4776bdad9b741a1e8345b41737245b80f4cf8d361ebb1ae5415c7a4fe1eb – base64 encrypted wiper 9a39423ec90dc06a3058279cd744c08d83252d1c7096633b9853e435cc205755 – deobfuscated wiper Network: dears[.]serveirc[.]com whitesalad[.]zzrak08526[.]workers[.]dev

A recent campaign exploiting the Oman Ministry of Foreign Affairs has been identified by ClearSky. This lure referenced the Iran–Israel war and the Middle East's "day after" and was sent to multiple ministries of foreign affairs. Similar obfuscation techniques were used by Iranian threat actors in 2023 when they targeted Mojahedin-e-Khalq in Albania. We assess with moderate confidence that this activity is linked to the same Iranian threat actors. IoC's: Sha256: b3c3ce80453d69ffc9db05ab3105f891feff6cd8d92d4907a6ee2fb701d590dd b2c52fde1301a3624a9ceb995f2de4112d57fcbc6a4695799aec15af4fa0a122 05d8f686dcbb6078f91f49af779e4572ba1646a9c5629a1525e8499ab481dbf2 03828aebefde47bca0fcf0684ecae18aedde035c85f9d39edd2b7a147a1146fa 02ccc4271362b92a59e6851ac6d5d2c07182064a602906d7166fe2867cc662a5 76fa8dca768b64aefedd85f7d0a33c2693b94bdb55f40ced7830561e48e39c75 2c92c7bf2d6574f9240032ec6adee738edddc2ba8d3207eb102eddf4ab963db0 2c92c7bf2d6574f9240032ec6adee738edddc2ba8d3207eb102eddf4ab963db0 80e9105233f9d93df753a43291c2ab1a010375357db9327f9fe40d184f078c6b f0ba41ce46e566f83db1ba3fc762fd9b394d12a01a9cef4ac279135e4c1c67a9 3d6f69cc0330b302ddf4701bbc956b8fca683d1c1b3146768dcbce4a1a3932ca 1c16b271c0c4e277eb3d1a7795d4746ce80152f04827a4f3c5798aaf4d51f6a1 1883db6de22d98ed00f8719b11de5bf1d02fc206b89fedd6dd0df0e8d40c4c56 3ac8283916547c50501eed8e7c3a77f0ae8b009c7b72275be8726a5b6ae255e3 Network: screenai[.]online

Recently we identified a notable uptick in TA455 related activity tied to the ongoing Iranian "Dream Job" campaign. Tactics, techniques, and procedures (TTP’s) of the group seem to be evolving continuously, demonstrating a high level of agility. We discovered new unknown malware associated with TA455 during our monitoring. The malware file originated from Azerbaijan, and had zero detections. This malware file has a valid digital certificate issued to the Swedish company "RGC Digital AB". Additionally, we discovered another file related to the same campaign: airbus-survey-portal(1)[.]zip . The files inside were digitally signed with a digital certificate belonging to second Swedish company: "Sevenfeet Software AB". Both attacks share the same (C2) infrastructure, on Azure-hosted websites: healthcare-azureapi[.]azurewebsites[.]net Sha256: d2db5b9b554470f5e9ad26f37b6b3f4f3dae336b3deea3f189933d007c17e3d8 7c77865f27b8f749b7df805ee76cf6e4575cbe0c4d9c29b75f8260210a802fce   5d832f1da0c7e07927dcf72d6a6f011bfc7737dc34f39c561d1457af83e04e70   3b58fd0c0ef8a42226be4d26a64235da059986ec7f5990d5c50d47b7a6cfadcd Domains: pharmainfo[.]azurewebsites[.]net   medicalit-imaging[.]azurewebsites[.]net   mentalhealth-support-portal[.]azurewebsites[.]net   healthbodymonitoring[.]azurewebsites[.]net   healthcare-azureapi[.]azurewebsites[.]net   healthdataanalyticsrecord[.]azurewebsites[.]net   medical-deepresearch[.]azurewebsites[.]net   patient-azureportal[.]azurewebsites[.]net   symptom-recordchecker[.]azurewebsites[.]net   systemmedicaleducation[.]azurewebsites[.]net   automation-platform[.]azurewebsites[.]net   azureapi-gateway[.]azurewebsites[.]net   bigdata-analytics[.]azurewebsites[.]net   cloud-servicesapp[.]azurewebsites[.]net   dashboardmonitoring[.]azurewebsites[.]net   developerportal-tools[.]azurewebsites[.]net   software-solutions[.]azurewebsites[.]net   software-solutionsresults[.]azurewebsites[.]net   tech-consulting[.]azurewebsites[.]net   techsupport-portal[.]azurewebsites[.]net   techsupport-tracker[.]azurewebsites[.]net

We have identified a widespread campaign in Ukraine that distributes malicious PDF files. Documents claiming to be from tax[.]gov[.]ua are disguised as official messages. When the recipient clicks the download link within these PDFs, a JavaScript file with a double extension will be delivered. A remote-access tool "Netsupport RMM" is installed and launched when this file is executed. According to our assessment, this operation is linked to the threat actor UAC-0050 with moderate confidence. IOCs: 7210910fb2c84cf68db7cc5f6bcb7cb4eb7cb8d09f5cebf89a03030894eff729 67c7363b39d3cbfe7f2bb4c4e8352a094be89ff61ba35d7589235ebb55fc3d1f ee2dae178a3cdc2c926bbb80c0d8c012a0a5fc105aed88e487deb24d7de26b77 97414f32627937f7ae51ef8dca88fdc48f4ec0c4d5ad7b807fb5eaff4b6f834a f85504ea6ef00b3123084a4225ac0a673d68f96df4247d2c2d9dee1a7e6314fe 2ce2e0d88f2fec7349ac9088ffdd4bc7df6e8f84d33b0e90ec9f993f7a4c28e4 557dcd6669c7d8bd25c3837c9cbf1b1b7fbea59e51f2d98659d0ba640a7a1ed3 470252fd866904e9843997e672959208accbce3f943cac4bc569de44641fb7d4 6994e9b7311ef1f2de15199fb73e498f22e10d2fcb475f0895237e275824f772 e74e7f4d4671ba9b644da098d96b5115e50f38cb9b6aeddfe24439fc543dfdbf a47c65a4dbc1a71a3c9ae802b7082f1ebbe4b4282140b425a079f778ca0cd1d7 4ad2b8119332f36e8a616899e7fdb5d94a1a95a5d6739dfee7fe157b1abd6c3a 53c59e0c9996c57c9c34d7201eada6f26afdd32839e5fb2fb1639080244a5477 7c29947109cb1fe9fd037843519f5c810e8d50d18c04c40d808f098b855f2f35 536cec8d036cebd1b4bef57421d4f646673c4b639c4ec6128cce84d80fbae009 8b3762edca4119d2c19351122f6d5d5650e36838c5db860a8423ab428c3ac770 bbe8b93ed35fff59fc6ccc320e225fe6a1cd010ca23f384580ab9a5b84d34bea f9ce078493c8a5b6e19bd8691d39213fd3537caa486501d10e961ecbcb7ea143 e1d495f0b358993b27d0e75b80420c4a427617ca326c91712214e7a2319bd6da 27bfff912592c68bbac26ee0cdbcfad0497c148ffcdefc1dad00c06b0bd6e4a5 ca89f0c5cc7f0dfa89e53fe943c64be0b9cfadb01fc374ad5dcdd19889e7421b 289e66003f803b23355975a4204ad56ca3fbeaaaba086b540d9375c0aa07e216 b5edeaa3f3cf420c20f87fda3ae0d0c41b79eec1d07d67e1f34525c145d8c270 836b4d63c9ca076a80587a72fbbd033c3861756b1b2c63134f2221070d1e1a20 26aa50444093c647af2db2e8ef7cc75ee2f3ec333ef4099f08f46c3b0d984512 e43814db00cd451a7b5db154c34db5187c4fe9a4110a46f85d868f5d4e90d1f8 6cc323e011de4241592f21cc96a82b107d3bbc2b8339c99535e21fae3217c646 8298f7df9270d939aa3f2d47d4a73ccc532be85bc36852659813353de0ecb586 f300181deec4c574b5db21b55ecdc1194845c9447ea0878746b066ca6e1af570 01cab28b3a523be1f3cc8a383b22732b12ee3c10f23ae2aa5ac7892150d62067 24676dfc50c72455e78812384f5be015d514131ff30a7e1d49836380e5567b53 a68c9c5bfb35d9e64d6fed66888f8b4b7e1eb016beb1a5bc4a01904a43fcf46f df986b596e9fd81d27adb55bcdb9021ab580b939b81770164adeaad85c422490 fee07f3528bb64c6803beac2bc39726fb7315fd0036987ab304640bf2d99e018 0a28ea87218b3bc3f6a2b94e579fd4523f0c700901937723dfd9884e0b385a2f bec19aa327c26b076d7093106e8e92fde0c9ba63d18a42d2b6ad2a5ac6d75966 2e86566e59c2e45f2242c769b373274a2db052f258fa6629a55323fc3ea90807 44563eb1825d651fc61842cf9049987351847b24db9b2f0b4afedecb9a744013 86ad4e5d654c2397acba6df46bbd55b97c9619bc0e1e0114be5ca632abbc74ba 3196b5e70714961f36cc008c0423cbb82b279dc946e5d3d8ecd3e0243ce64dca 3ac406e481211940c267b60c303840aeb7c24a4908e89f41e6518b70ce76d623 b3fd77cf45f5a2e8b21090534e0a3815a133dbe06d9cf692a4378821824212c6 ae4b4f5e8fef550a07df6237e422cebc3c06fab337e26eac94fbfea162fd312e 5f47479a7e18d7773b61b2268b7d459a917cc520f5a08734ddeffcafdfb513ca 34982a50b69e19d92522bd8a4c90180707b8fc66582d02443ac251f0061d4453 89740f3383736af6922b833e3d364f40b06b13699ce8ae36cf86ff81f66e2242 64eca8fc57293ad031e1802d54258230b42f64cafbf9e5c7e1f3eef60b911ce2 99fe5fe954faa0a85f30d219f3191577075f3119030d3aebfa5f487798aba911 559e8b924d7af2fabc2c263bad56348198f3eff527e7e7f04735ec90fcb677ed 3c134f011263096b682ad459e25c3c85db1f95050dda78630734081761131e17 450ccaab220c6236186e2fd15c5675db1066510c24dce4d86effb6ee48465012 b4f96afbb4e761b3aaf006aac6bf05ab96f39820d25dba95c2b20d56e90667e7 8457f72260e2dd864279f330b247f4ca42cb73b957eb32e1b729b7c9b5cde32a 9417399b12b35fe11ac0f279d84d2d922f0d37d6154368d3485a901cfe1eb55c a877b0f4aeea583ce1a85abd04025cf12f5b271e67aa8a6bd6cbae4f65fe8ee7 ac49edf65d34de94a2b331eaa77d98304bc874a2b11d8aa2776f1461a88cf4d4 32f760fc6cd43d815763e1fb20ecbc23861d92f69533739ff88c12118cdcb207 bb818ef6a7d21f94f33231bc076d149f07fc90bf38c93b7f4943b45a3036d901 adfc386dfbb05676b82fc7dc57110b039a9df1b11130053a1ef15b9c99c30d6a 2780b4d2729fcc5095dc0e8c5b01c4fdc31f6b8940c8e8fb84bdb02ab3037aa9 6aa47daf81d2a15be88600a3a1c837a90f404a1601eb91b4a8fee38fdd4a5f3d 6a8c15f126b828f6db5a6899cc3d30597cfa1e7eebbeb112d57b7208b988d5bd 585cdb21b21b2f25cf8e0785bd7a12556f5b8d9e741aef744219ba006789ce72 b8ffd5fe4062b42b0f821357c4838da4af6f4d370d5d0e96a3b4f976945b6e78 152649c81bdec73df2e00f0882c68e9b4cf8157dd21828cb445bc57e8bdb53f4 7dd7bed4cfaeb5495773b7a2e1714f52825cd55f6e3a15cdaaf0a8403146cb6b 2c95ea70bd8f0ccceac253f014ab3d767be2bae577de83753495d199b4db0255 5e117a23c58070ed632035dc6f8e2d772baccf6ccdd3cfe3abee853e07769a77 cd25595e997201becf73c1169b4840d0c6032f555b0d27e641bd7a181310acf1 165b5ce359c9bcdafa4b526d42cb417f488b95e5bd7ae98fd052f8a248262d00 1c7659bbd3e60176afb7fe281112afac54a0801573421ccc8be9ac9620124ccf 1d5212f1c237cbf5a014707bf606047fc6fd5e71b64351c2683a258a306402e4 cbaea8352d23362b3177ca16a84b199728eef8fb2f5b299426e56a0ba6addcf2 76a753d2c72512233f341f9046ad644a7c435d25c5b8f92d94767a131992fb2a 1f2b5d536fb00a728a13cfb1a3c22656c246c20f949334508d7a410cab846635 350fb67872dbe38cbe3014c2b0aae418d0ab50a0d84040158d081ed4b6363b28 5bd1c5c46b434928a5d46432c24bff1edf0c072029a2696b1c343f45bfe9a1c5 b910f05063f69ed68ac7bd0bd3fd4cc8602e3873c2426de0f762b886793d4067 ad7fa442990d926c3eca323161a78e544fe86c2d7f54a370c5e03f2ee3fe30a2 dcac33c9771c722a3f6db776ce16a18b7955b738b38bebe4c36d5a089345dcf1 eaf41f9ef10d403b02dac00a4faebade4d6c1f34f640917780d169912bde62c8 Malicious JS downloaded: ecd0262b8f8c0722f33baaeaf6f3b6a9ad2268aab48d49879f027e4d5c5e03ee The JS download a zip file containing Netsupport RMM: c2a2641ed571c1e025561ef1f6d3ffa2a9362c68bebb2a0884f638a8a06d37b9 domain: tciflusa[.]org IP address: 94[.]158.245.132

A suspected new malware variant linked to the MuddyWater Iranian APT group has been discovered. Based on the PDB path, we named it Phoniex. Phoniex was used in attacks impersonating the Hungary government and Netivtech, an Israeli company IoCs: Sha256: 376f96a5363f7d1d0bf269f2a35f6fa22bce52ceb6f3fedb0245534d69cfd5d6 40dead1e1d83107698ff96bce9ea52236803b15b63fb0002e0b55af71a9b5e05 ae4dee53be0ecc4a3b53174b5bf7a47a6155b16645c69c504fc4a3f7972c004b c3afd5ce1ca50a38438bb5026cca27bfbf2d8e786e03f323adceb8ad17517eca b99edfb9ef9e1fb4a587e4a4a66d1947739036887dd22e24602c877b0045f070 Network: netivtech[.]org 46[.]101.36.39

ClearSky discovered in early April a Yemeni/Houthi influence campaign operating in Israel, Saudi Arabia, and the UAE. In 2019, we first exposed the campaign. It continues to operate in a similar manner to what we uncovered in 2019. Between 2019 and 2022, the campaign focused mainly on Saudi Arabia and the UAE, before returning to Israel in late 2024. Visit our blog to read the report: clearskysec.com/blog/

ClearSky Cyber Security has been tracking a campaign active since December 2024, potentially targeting Ukrainian soldiers. The attack begins with an SMS or Whatsapp message containing a ZIP file that includes malicious LNK shortcuts. These LNK files act as droppers, downloading an additional ZIP archive that delivers the Remcos remote access trojan (RAT). The payload is executed via a legitimate file named DesktopX[.]exe, which is signed by Stardock Corporation and leverages DLL side-loading to evade detection. Indicators of Compromise (IoCs) identified in this campaign include 75 malicious file hashes and 17 IP addresses used by the attacker. IP Addresses: 38[.]180.49.67 38[.]180.49.87 80[.]66.79.91 80[.]66.79.159 81[.]19.131.86 81[.]19.131.95 146[.]185.233.90 146[.]185.233.96 146[.]185.233.97 146[.]185.233.98 146[.]185.233.101 146[.]185.239.33 146[.]185.239.45 146[.]185.239.47 146[.]185.239.51 146[.]185.239.56 146[.]185.239.60 Hashes(sha256): 121746df4264aca0c138d35bbe5e2c6eaaa60b72967a527687e83d7e2c653207 d7e0388fb362117c9c77b276bbf1e43fec455756c60cf521c20b0e99bbe2f47c c9e0fa889387f4e3a024049e37f6de49427d085328c4e3dcf398af5a1f62fcd0 8800edc6961be56a9d44f843d224f19b47834bd57037cff2041b7c563d3d2422 9ed972e4bd181c65ca053dcf0220f4101a51387517b4c0c5f7ce6cf49895de27 cdd21e4f9ff1d1cfcf4888342fa2be5452eb3cbe7ba28e4e98fa44c879fe0265 2bc8446ee880b1097e1220e1922251f209b5368e1388c135c032ba01f32b8b5a 9808c30536102888d01ec6029eaca97db8f77edff2916de777be0be5965d9c11 fbd030b53088a536d7e6b6a80e4767c097fbfcb11a921dd7c0fa938322f96842 a98810a2ba2427067d2412bf67f47f93e22989607d69fc17ff9ac6fc774674cc c4fe2d94b70d4c047a8305d62379b140d0d4785a89d861a3adf0bcbaa285f5ea 413d8a1f6e2cc9e9d5e25794c6c7652b180d52345bedd3efdee6fe741a426ef3 033de779278ecfdee7117d5d0a710e22eb501421e0c5f93e4ea3e82f414bbb90 b425784330756dacfa2031886b150c5775b7865671df1b94ec9217d299306dc2 50d8fe30189d9f429714f797013a331e565c06d34d4b672894172708ed8c29d5 5b2ad349dd02a00bc8860294657139d681b0c786afcbcb1ffab77f57b01e7b00 bf4f4cad998e791a3627e0b92aab9b73c32056f232c4045bd84055d2d30e5024 3e6aba2e295f519978f1d42a845126593809af6f15c1166eec39382595277975 048642a4773c5b3bb0b1cbc260a4f08c5db6c95a390971347ea5b055ed1b4dbe 26f5293d5f6a503217f6bb0fdc5a98cc2f5d354b65980111f5817c80ddcd0254 693874fcf694a9a9ad04fe75d96de7fe9ebe2e07ee1441c79ac3e8eb8aeb06b5 1175caec6deb53fa86152d6960ad0b8e2501e5485f0e541a02ebd88bb3567f90 0ca3239a90cc3421062090129932050f793e2fb81498711703a9d32967aba9ce ff26b2cc11696d5931757cc6bdafb1163f48b7f41f17d1e593ea3ee9f5176e2e 4161d7037b807c1472cb2e01ccd3a68827ccc765c3d6ff35d8093f350624fedf c4d4213ff3b737fe20248362687a0cd3008b630a65b230b06fba282379665c83 b861ff7b2647fe1370519553e5e798c8bc1a25984261236847d009e82a63a52d dc02cfebbc64d6dbcc3a1b1a2cc91cb763c0be9a72ac141c2f06db74aa56cfe7 27e226d57abfb671b676eb82fe286db0964d35fff73c905573550052e0242176 3a97b6d7af2b5388d99431211bdf1eb67de6f0ea4b253b447be675018d22cbe0 f76dfaab6e248d88241a17b5a58fd2405d0d1954364bce9144156eba3904dd6a 393421a3673ef684fb916c4b61efdde54d76f14787b422e1a469e5e97b5c098a 7ff52c2ebe11fa35626172f15bef9459333b2ff763665454de93740387556cc2 7cf95a57db9a4f719ef40f490bee9d6d4e8f602f13f8e0a52f332228301b3ca5 c64554c29d798e6006aa5845da7252f18c01e305f61071e314a23ab143ed73f8 9121629f2c214ba3e465e8e50df85ca7be7158470dfe8305101dafcfeb0f1c16 236850ae28015cf9b0f20a677ade5bef2a85bef665585c48d88cc00a823323ad ef0b2e0c337e11a94279025f9cdeba519d1aee7c1af3013053fe510955e2aa85 eb8da26034035f08946acb6fc127e3b2db884a024a61aea99397c46aedc70145 b412fe51dc935a7439ad1e5f46c1585e8fb23d9ba991f459275be653c5938dd2 43a9f0a3963d700a6d586c65fc7fdd1bb562b861942c384e7767213cf1059ef9 a22faecee43024ce94c9ddf3bd3f89e1abf91c3ac9f98755a4a1ab7ed4624501 13a7d5a61580de30e07909f723b5263c2d6785d73f910e844236adc453175227 b34cc0a4ee0bfff6d788387730a748ad9055456a648d072d436e44ef7050babc 4bbb677e5c00a14fbae24569cbe18fe79fdb32f38ce1adc24809908665e60366 134d02ddcc75a2d7e0e1824d430ba2e9a2a96682452fa6ec84660ed5d0a88023 3dc9bb3704bd0a275e466d95ad9ed30f73cc572a95111c9b6397a64f3d866573 d0e8a91af95d62dc58dbfd64970f1b255c6bffedeaf21b3e6ec4e89496f6c67a 769ca298ed1d3117e623b40597f09d14c68d8f015573e5a5279922dfcb10ede1 0321758329ca44f1c9f7e15a37f081df39ba37598b1547d2f2bbc839b34f0b2b 502104d48d0a4735a6a051744277c9231f8da156311ec99367bca50b7a47a613 9f5e1e240be52cadcfd4d72fcc758a5d577a3c9a70c9c5f06ee8a3d06061c76b 5a26624600d7ef102375317a32db739531bfab91335131edd1e2362f2753e693 8087db3c43840caccb9756893cdaff707311dc195f34de471cc259b1b62e3411 4117245310c57f687d0c353c06a6eda4c1e93ebee33fb5f712142c272a3c1108 be6428c025463ca409b8514229078b08ffb50effa88fb3dde034a40f66ee475e 83024c7a9ba256a36fb9b751926170c08dd4daa1866c119856cd091b1275897f 730024579e8616c9c4e63abebc6bc6c9937c570be36bec5db3e203ece2c362eb 2005829bdb11070ba927dfb30b162c67ad8bd3b20d530ce58df7f4522d8c7ed1 9f7c6186c8d5a331af69602a83333c3a6f5849f9533e1b53b235fd5e3441be56 d005cb80c6bb1d82e4a86838b5c3e593bdf207f99ac205248688ff82621a3c12 dab6a7024000e603c4c11bc92a855790fdada52530eea87df54a1d98a71866e6 00b2903754fef454a720d5ace6688e6c79c168573268de26aa04cf72ea6b54d5 b5e39eae6faf09cc089ccddb565fa2caed7671f77e4ac3a32c4433129c6453ef 4ca519ed18ef7c67f56875a233f6a076ac9bc1d6117d938b6662984a762db192 1363680b09ab56b23c65e47f989988e3edcd92392398d20a0935652efdf32b70 3a32ef48694471ca25c2429c05ec04cfe75fe778db39d4bda4de6492dc4a0142 261d931e086e7363d37fd7fcf1421e45f1d77cdd73d4b9b4e76a116e732d2a46 9fc98a6fa4165b9c28fb372b9d352a575b5eef34150653a4a1f76166319ef105 a9e0b882389d13a86cc9387571c85293f85491e7b7b6d05447229cbe6dc3ccea 6c76831be4413e43efd9d1fbc0aac1057122befaf8adc41cad0fdd75e1c4879a 1de6008e517d2566c14b2ba26b3cc6bba214b1662d2c142d5e77e0fc30c8a589 de4a9e744beb235a01d7f2a019016c67c303a86774422f643af32a2913b78010 bd958d61cbed949462a0d4e951b20da6734d1319068b6cad444310ef192559f9 98ff5489cf62146d24c335427aab0adc2a301a5ca5804ba86f5112d666dc3dce

ClearSky Cyber Security has discovered a UI vulnerability in Microsoft Windows. This vulnerability is actively exploited by a suspected Chinese APT group - Mustang Panda. When files are extracted from compressed “RAR” files they are hidden from the user. If the compressed files are extracted into a folder, the folder appears empty in the Windows Explorer GUI. When using the "dir" command to list all files and folders inside the target folder, the extracted files and folders are "invisible/hidden" to the user. Threat actors or users can also execute those compressed files from a command line prompt, if they know the exact path. As a result of executing "attrib -s -h" to system protected files, an unknown file type is created from the type "Unknown" ActiveX component. More details will be published in our blog. Microsoft classified it as a low-severity vulnerability. MD5: 3bd2eeda66ec057727be8810fee5da38

A new infrastructure for the Russian information warfare campaign named Doppelgänger has been discovered by ClearSky. “Doppelgänger” (meaning an exact but usually invisible replica) is a global information warfare campaign publishing false information on fake websites and social media channels. Our research revealed that “Doppelgänger NG3” is fully operational. Few samples from Germany, France and Israel: forge of spiegel.de forge of leparisien.fr forge of walla.co.il

A new zero-day vulnerability, CVE-2024-43451, was discovered by ClearSky. This vulnerability affects Windows systems and was actively exploited in attacks against Ukrainian entities. The malicious URL files were disguised as academic certificates and were initially observed being distributed from a compromised official Ukrainian government website. CERT-UA linked this campaign to the threat actor UAC-0194, suspected to be Russian. Microsoft released a security patch for this vulnerability on November 12, 2024. Read the full report in our blog: clearskysec.com/0d-vulnerabi…

ClearSky Cyber Security research identified a campaign named “Iranian Dream Job”, in which the Iranian threat actor TA455 targeted the defense sector by offering fake jobs. The campaign distributed the SnailResin malware, which activates the SlugResin backdoor. ClearSky attributes both malware programs to a subgroup of Charming Kitten. The similar "Dream Job" lure, attack techniques, and malware files suggest that either TA455 was impersonating Lazarus to hide its activities, or that North Korea shared attack methods and tools with Iran. Read our full post : clearskysec.com/irdreamjob24…

The Iranian APT group MuddyWater is attacking Saudi Arabian organizations using PDQ Connect RMM software and internxt[.]com storage services ITW: hxxps[://]share[.]eu[.]internxt[.]com/d/sh/file/763a0e5 a-ef4c-4df2-9145-69e9717b393b/faa24bcca42513a92c733705c0aa90c922b75e532dcf3725044ff179d5ebf811 MD5: 79177cf0f9de8d40494334c8af29e25e

Using a new RMM tool "PDQ Connect" MuddyWater impersonated to: MKK from Turkey, a Jordanian company "Offtec" and IDF: offtecportal[.]egnyte[.]com 750308da76cbff35ee548f23439bc0d8 6780e3b13029ac58c96e3e59c0535d42 2690694b348358c9d1261db2e64ae5ef 29aa13acd46472b62cc0fbaa4c94062e