Hamas-affiliated Ashen Lepus targets Middle Eastern diplomatic entities with new AshTag malware suite

Ashen Lepus remained persistently active throughout the Israel-Hamas conflict, distinguishing it from other affiliated groups whose activities decreased over the same period.

Ashen Lepus continued with its campaign even after the October 2025 Gaza ceasefire, deploying newly developed malware variants and engaging in hands-on activity within victim environments.

This campaign highlights a tangible evolution in Ashen Lepus’s operational security and tactics, techniques and procedures (TTPs). While its operations over the years have demonstrated only moderate sophistication, the group has recently adopted more advanced tactics.

Read more at Unit 42