Loading malware…
IronWind is a custom Windows loader used in targeted espionage operations attributed to TA402, an activity cluster overlapping with WIRTE and the broader Gaza Cybergang/Molerats ecosystem. It emerged in 2023 in campaigns primarily aimed at government and public-sector entities in the Middle East and North Africa, and later appeared in WIRTE operations during 2024. The malware functions as an initial-access and staging component that establishes command-and-control communication, performs victim profiling, retrieves additional payloads, and executes follow-on code through multistage in-memory mechanisms designed to frustrate analysis and evade endpoint defenses.
Observed delivery has centered on phishing campaigns using politically themed Arabic-language lures. Across documented campaigns, IronWind was delivered through malicious attachments and archives, including PowerPoint add-ins, XLL files, and RAR-packaged sideloading chains that paired legitimate executables with malicious DLLs. DLL sideloading has been a recurring execution method, and later variants used reflective loading and shellcode stages to keep payloads in memory. IronWind has also been associated with geofencing and selective victim validation, indicating an effort to constrain execution to intended targets.
Operationally, IronWind has been used to collect host metadata such as operating system details, user and computer identifiers, installed software information, and related reconnaissance data for initial check-in. It then requests or reconstructs next-stage payloads from remote infrastructure, including payload material concealed within HTML elements, and can launch downloaded shellcode or .NET components. Reported follow-on stages included post-exploitation tooling and, in separate WIRTE chains, delivery of Havoc Demon. The malware’s use of custom user-agent logic, staged decryption, and memory-resident execution reflects a loader built for stealthy access brokering and controlled tasking rather than standalone destructive action.
IronWind is best characterized as part of a broader Palestinian-aligned cyber espionage toolkit. Its known use has been closely tied to campaigns against regional government targets and other politically relevant organizations, with later WIRTE activity showing overlap between espionage-oriented tooling and more disruptive operations. High-confidence reporting supports IronWind as a loader/downloader family used to establish footholds and hand off execution to later-stage implants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind. The downloader was followed by additional stages that consisted of downloaded shellcode.
From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind. The downloader was followed by additional stages that consisted of downloaded shellcode.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind.
During Proofpoint’s analysis, the shellcode used reflective .NET loaders to conduct WMI queries.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
IronWind is a loader used by the Wirte APT to deliver additional malware through a multistage, memory-resident infection chain, designed to evade detection and frustrate analysis.
Custom loader used by WIRTE/TA402-linked activity to profile victims, beacon to C2 with a hardcoded user-agent, and retrieve/execute next-stage payloads embedded within HTML tags; observed delivered via RAR + DLL sideloading chains.
IronWind is a multifunctional initial access downloader/loader used by TA402 in targeted phishing campaigns against Middle East-based government entities. It is sideloaded via DLL files, checks in to actor-controlled C2 infrastructure, receives shellcode as follow-on stages, performs system reconnaissance, and downloads additional .NET payloads for post-exploitation.
Malware that executes via DLL sideloading.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.