TA402 Attacks Governments in The Middle East

A threat group known as TA402 is targeting government institutions in the Middle East by sending malicious emails containing links or Arabic-language PDF attachments with geopolitical themes. The campaign uses geofenced URLs to deliver password-protected RAR files containing LastConn malware. LastConn is a backdoor that allows the threat actors to run arbitrary commands, take screenshots, and exfiltrate them via Dropbox.