Middle Eastern Governments Targeted by ‘Witchetty’

Witchetty, an espionage-focused threat actor, targeted governments in the Middle East by exploiting Microsoft Exchange vulnerabilities including ProxyShell and ProxyLogon. The attackers deployed web shells, leveraged steganography techniques to conceal payloads within image files, and used the X4 first-stage backdoor and LookBack malware to establish persistence, conduct reconnaissance, steal credentials, move laterally within victim networks, and deploy additional malicious payloads. The campaign primarily focused on intelligence collection from government entities.