TA402 Targeting Middle East Government

A phishing campaign is targeting government entities in the Middle East. This campaign utilizes a new malware variant known as IronWind to deliver malicious payloads. Proofpoint has reported that a threat actor known as TA402 is actively targeting government entities in the Middle East. The threat actor uses a new malware called IronWind to deliver malicious payloads. IronWind is a multi-stage malware characterized by its utilization of various techniques to evade detection. In its initial stage, the malware functions as a downloader, retrieving the second stage from a remote server. The second stage serves as a dropper responsible for installing the third stage, which constitutes the payload. This payload operates as a backdoor, enabling remote control of the infected system by the threat actor. In their recent campaigns, TA402 has been utilizing a compromised Ministry of Foreign Affairs email account to distribute phishing emails containing Dropbox links that lead to the deployment of IronWind malware.