AshTag

AshTag is a modular multi-stage espionage malware suite used by the Hamas-affiliated threat group Ashen Lepus, also tracked as WIRTE, in campaigns against government and diplomatic entities across the Middle East, including targets in Palestine, Egypt, Jordan, Oman, and Morocco. The malware is designed to support long-term intelligence collection by stealing sensitive documents, maintaining access on compromised systems, and enabling remote operator tasking.

The framework is composed of a loader, a stager, and a .NET backdoor/orchestrator component, with support for additional modules. Reported functionality includes remote command execution, file theft and exfiltration, host profiling, screen capture, in-memory loading of follow-on components, and modular extension of capabilities. The malware emphasizes stealth through staged execution, encrypted and encoded payload delivery, and reduced disk artifacts. It has been observed masquerading as a legitimate utility and using an orchestrator component to manage communications and execute additional payloads in memory.

AshTag has been delivered through spearphishing campaigns using realistic Arabic-language diplomatic and geopolitical lures. Victims are enticed to open benign-looking documents that lead to archive downloads containing decoy content alongside malicious components. Execution commonly relies on DLL sideloading with a legitimate executable and malicious DLL, after which a harmless document is displayed to reduce suspicion while the malware continues in the background. Additional payloads and configuration data have been concealed within HTML content and recovered through decoding and decryption steps.

The malware reflects a notable maturation in Ashen Lepus tradecraft, combining social engineering, DLL sideloading, modular design, and in-memory execution to conduct persistent diplomatic espionage while blending command-and-control traffic with legitimate-looking web activity.