Summary
This technical report details the activities of the WIRTE advanced persistent threat (APT) group, which has been operational since at least August 2018. The report outlines the group's targeting of various organizations in the Middle East and Europe, particularly focusing on entities such as the Palestinian Authority, Jordan, Egypt, and Saudi Arabia. It highlights the use of custom loaders in recent attacks and presents a comprehensive analysis of 56 indicators of compromise (IoCs), including domains, IP addresses, and subdomains. The report further expands on the findings by detailing additional artifacts connected to the WIRTE group, including email-connected domains and malicious IP addresses. The analysis includes data on the registration and geolocation of these IoCs, as well as their historical DNS resolutions. The report concludes with a cautionary note regarding the identification of threats and the importance of further investigation into the entities flagged as malicious.
