Middle Eastern APT Group TA402 Launches Sophisticated Cyber-Espionage Campaign Using IronWind

A Middle Eastern advanced persistent threat (APT) group known as TA402 has recently launched a series of targeted cyber-espionage attacks. This group, also known as Molerats or Gaza Cybergang, has gained attention for its support of Palestinian intelligence gathering objectives. In their latest campaign, TA402 demonstrated new tactics, particularly the use of a new initial access downloader called IronWind.

Background on TA402

TA402, also known as Molerats or Gaza Cybergang, is an APT group that operates in the Middle East. The group is known for their support of Palestinian intelligence gathering objectives. In their latest campaign, TA402 showcased new tactics, with IronWind being a notable addition to their arsenal.

Infection vectors

TA402 utilized various infection vectors in their cyber-espionage campaign. These vectors included Dropbox links, XLL file attachments, and RAR file attachments. Each of these led to the download of a DLL file that contained multifunctional malware. This allowed the group to gain initial access and execute their malicious activities.

Shift in communication methods

In a change of tactics, TA402 moved away from using cloud services like the Dropbox API for command-and-control (C&C) communication. Instead, they started using actor-controlled infrastructure. This shift highlights the group’s adaptability and efforts to avoid detection.

Phishing campaigns

TA402’s phishing campaigns were conducted through a compromised Ministry of Foreign Affairs account. The group targeted various Middle Eastern government entities using a spoofed Gulf Cooperation Council lure. By masquerading as a trusted source, TA402 aimed to trick unsuspecting targets into opening malicious attachments or clicking on malicious links.

July Attack: Initial access through a Dropbox link

In July, TA402 employed a Dropbox link in a phishing email as an infection vector. The malicious email contained a PPAM file, which, when opened, executed a macro that dropped three files. One of these files sideloaded IronWind, providing the group with the initial access required to carry out their cyber-espionage activities.

August Attack: XLS File Attachment

In August, TA402 shifted tactics and began sending phishing emails with an XLL file attachment as the infection vector. This attachment allowed the group to load IronWind onto the targets’ systems, enabling further infiltration and data exfiltration.

October Attack: RAR File Attachment

In October, TA402 once again modified their tactics, this time using a RAR file attachment to sideload IronWind onto targeted systems. The RAR file contained a renamed version of tabcal.exe, which enabled the initial access needed for the group to execute their cyber espionage activities.

Exploitation of the war in Gaza

TA402, known for its support of Palestinian intelligence gathering objectives, has begun using the ongoing war in Gaza as a lure in its phishing campaigns. However, despite the utilization of this emotional and sensitive topic, their operations have not been significantly disrupted. TA402’s ability to adapt and continue its cyber-espionage activities poses an ongoing threat to the targeted entities.

The Middle Eastern APT group TA402, also known as Molerats or Gaza Cybergang, has recently launched a sophisticated cyber-espionage campaign. Their adoption of the new initial access downloader IronWind, along with their evolving tactics, showcases the group’s ability to adapt and remain a persistent threat. By exploiting various infection vectors, including Dropbox links, XLL file attachments, and RAR file attachments, TA402 has been able to gain initial access and carry out multifunctional malware attacks. Their shift in communication methods exemplifies their efforts to avoid detection and maintain control over their operations. While TA402 has incorporated the ongoing war in Gaza as a lure in their phishing campaigns, their operations have largely remained unaffected, underscoring the need for heightened cybersecurity measures to mitigate their threats.

Explore more

Trend Analysis: Robotic Process Automation in Supply Chains

In an era where supply chains are under relentless pressure to deliver faster, smarter, and more efficiently, technology has emerged as the linchpin of transformation, with Robotic Process Automation (RPA) leading the charge as a key driver of innovation. This innovative approach, which employs software bots to handle repetitive tasks, is reshaping how businesses manage logistics, inventory, and customer expectations.

Lead Generation or Brand Awareness: Where to Focus?

What if a small business owner had to choose between landing a sale today and being remembered tomorrow? In the fast-paced digital landscape of 2025, this dilemma grips countless entrepreneurs who juggle tight budgets and endless marketing options, forcing them to weigh immediate revenue against lasting recognition. Picture a local coffee shop owner debating whether to run a quick ad

Role-Specific Dashboards Transform Data Access in Business Central

In today’s fast-paced business environment, decision-makers often find themselves drowning in data, struggling to extract meaningful insights from generic reports that fail to address their unique needs, which hampers productivity across industries. Picture a manufacturing executive sifting through endless spreadsheets to uncover critical financial trends, or a retail manager buried under irrelevant metrics while trying to optimize store performance. This

Building a Dynamics 365 Center of Excellence for Success

In today’s fast-paced business landscape, implementing Microsoft Dynamics 365 Finance and Supply Chain Management (D365 F&SCM) marks a significant milestone for organizations aiming to streamline operations and boost efficiency. However, achieving true value from this powerful platform extends far beyond the initial deployment. Many leading companies recognize that sustained return on investment and continuous improvement hinge on establishing a dedicated

Top 10 Benefits of Hiring an Agency for Email Marketing

Email marketing stands as one of the most powerful tools for businesses aiming to connect with customers, yet many struggle to harness its full potential. Consider this striking statistic: for every dollar spent on email marketing, businesses can expect an average return of $42, showcasing its unparalleled value in driving revenue. However, crafting campaigns that truly resonate requires time, expertise,