An In-Depth Analysis of the Ashen Lepus AshTag-Enabled Attack

Palo Alto Networks’ Unit 42 has been tracking and monitoring Ashen Lepus’s cyber espionage campaign that leverages a new malware suite they dubbed “AshTag.” The researchers witnessed a tangible evolution in the group’s operational security and TTPs.

Unit 42 identified 12 subdomains as IoCs.¹ Upon further scrutiny, we extracted 10 unique domains from the subdomains, bringing the total of IoCs for our in-depth analysis to 22.

Our investigation of the 22 AshTag IoCs led to these discoveries:

• 12 subdomains identified as IoCs tagged as malware distributors
• 430 unique client IP addresses that communicated with one of the domains identified as IoCs
• Two domains identified as IoCs deemed likely to turn malicious upon registration 75–752 days before being dubbed as such
• 29 email-connected domains
• One IP address, which turned out to be malicious
• 50 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/