Middle Eastern APT Group TA402 Launches Sophisticated Cyber-Espionage Campaign Using IronWind

A Middle Eastern advanced persistent threat (APT) group known as TA402 has recently launched a series of targeted cyber-espionage attacks. This group, also known as Molerats or Gaza Cybergang, has gained attention for its support of Palestinian intelligence gathering objectives. In their latest campaign, TA402 demonstrated new tactics, particularly the use of a new initial access downloader called IronWind.

Background on TA402

TA402, also known as Molerats or Gaza Cybergang, is an APT group that operates in the Middle East. The group is known for their support of Palestinian intelligence gathering objectives. In their latest campaign, TA402 showcased new tactics, with IronWind being a notable addition to their arsenal.

Infection vectors

TA402 utilized various infection vectors in their cyber-espionage campaign. These vectors included Dropbox links, XLL file attachments, and RAR file attachments. Each of these led to the download of a DLL file that contained multifunctional malware. This allowed the group to gain initial access and execute their malicious activities.

Shift in communication methods

In a change of tactics, TA402 moved away from using cloud services like the Dropbox API for command-and-control (C&C) communication. Instead, they started using actor-controlled infrastructure. This shift highlights the group’s adaptability and efforts to avoid detection.

Phishing campaigns

TA402’s phishing campaigns were conducted through a compromised Ministry of Foreign Affairs account. The group targeted various Middle Eastern government entities using a spoofed Gulf Cooperation Council lure. By masquerading as a trusted source, TA402 aimed to trick unsuspecting targets into opening malicious attachments or clicking on malicious links.

July Attack: Initial access through a Dropbox link

In July, TA402 employed a Dropbox link in a phishing email as an infection vector. The malicious email contained a PPAM file, which, when opened, executed a macro that dropped three files. One of these files sideloaded IronWind, providing the group with the initial access required to carry out their cyber-espionage activities.

August Attack: XLS File Attachment

In August, TA402 shifted tactics and began sending phishing emails with an XLL file attachment as the infection vector. This attachment allowed the group to load IronWind onto the targets’ systems, enabling further infiltration and data exfiltration.

October Attack: RAR File Attachment

In October, TA402 once again modified their tactics, this time using a RAR file attachment to sideload IronWind onto targeted systems. The RAR file contained a renamed version of tabcal.exe, which enabled the initial access needed for the group to execute their cyber espionage activities.

Exploitation of the war in Gaza

TA402, known for its support of Palestinian intelligence gathering objectives, has begun using the ongoing war in Gaza as a lure in its phishing campaigns. However, despite the utilization of this emotional and sensitive topic, their operations have not been significantly disrupted. TA402’s ability to adapt and continue its cyber-espionage activities poses an ongoing threat to the targeted entities.

The Middle Eastern APT group TA402, also known as Molerats or Gaza Cybergang, has recently launched a sophisticated cyber-espionage campaign. Their adoption of the new initial access downloader IronWind, along with their evolving tactics, showcases the group’s ability to adapt and remain a persistent threat. By exploiting various infection vectors, including Dropbox links, XLL file attachments, and RAR file attachments, TA402 has been able to gain initial access and carry out multifunctional malware attacks. Their shift in communication methods exemplifies their efforts to avoid detection and maintain control over their operations. While TA402 has incorporated the ongoing war in Gaza as a lure in their phishing campaigns, their operations have largely remained unaffected, underscoring the need for heightened cybersecurity measures to mitigate their threats.

Explore more

How Is AI Revolutionizing Payroll in HR Management?

Imagine a scenario where payroll errors cost a multinational corporation millions annually due to manual miscalculations and delayed corrections, shaking employee trust and straining HR resources. This is not a far-fetched situation but a reality many organizations faced before the advent of cutting-edge technology. Payroll, once considered a mundane back-office task, has emerged as a critical pillar of employee satisfaction

AI-Driven B2B Marketing – Review

Setting the Stage for AI in B2B Marketing Imagine a marketing landscape where 80% of repetitive tasks are handled not by teams of professionals, but by intelligent systems that draft content, analyze data, and target buyers with precision, transforming the reality of B2B marketing in 2025. Artificial intelligence (AI) has emerged as a powerful force in this space, offering solutions

5 Ways Behavioral Science Boosts B2B Marketing Success

In today’s cutthroat B2B marketing arena, a staggering statistic reveals a harsh truth: over 70% of marketing emails go unopened, buried under an avalanche of digital clutter. Picture a meticulously crafted campaign—polished visuals, compelling data, and airtight logic—vanishing into the void of ignored inboxes and skipped LinkedIn posts. What if the key to breaking through isn’t just sharper tactics, but

Trend Analysis: Private Cloud Resurgence in APAC

In an era where public cloud solutions have long been heralded as the ultimate destination for enterprise IT, a surprising shift is unfolding across the Asia-Pacific (APAC) region, with private cloud infrastructure staging a remarkable comeback. This resurgence challenges the notion that public cloud is the only path forward, as businesses grapple with stringent data sovereignty laws, complex compliance requirements,

iPhone 17 Series Faces Price Hikes Due to US Tariffs

What happens when the sleek, cutting-edge device in your pocket becomes a casualty of global trade wars? As Apple unveils the iPhone 17 series this year, consumers are bracing for a jolt—not just from groundbreaking technology, but from price tags that sting more than ever. Reports suggest that tariffs imposed by the US on Chinese goods are driving costs upward,