The malware is distributed by TA402, a threat actor also known as Molerats, a Middle Eastern advanced persistent threat (APT) group that often targets entities in Israel and Palestine, in addition to other regions in the Middle East.

Proofpoint says the custom malware implant it identified enables the threat actor to conduct reconnaissance on the target host and exfiltrate data.

Proofpoint lists key findings as:

• TA402 leverages political and military themes, including the ongoing conflict in the Gaza Strip, to entice users to open attachments and click on malicious links.
• TA402 activity is largely focused on entities operating in the Middle East, especially government or government-adjacent organisations.
• TA402’s custom malware called LastConn is used to gain access to and conduct information gathering activities.
• LastConn uses a number of unique features to deter automated threat analysis and make manual analysis difficult.

“TA402 is a highly effective and capable threat actor that remains a serious threat, especially to entities operating in and working with government or other geopolitical entities in the Middle East,” says Proofpoint.

“Researchers anticipate TA402 will remain very active, based on its return to weekly threat activity as of June 2021. It is likely TA402 continue its targeting largely focused on the Middle East region.

“To defend against exploitation, Proofpoint recommends recipients pay close attention when downloading and opening password protected archives, and only open them from trusted sources.”

To read the Proofpoint report on the malware attacks on government organisations click here.