Molerats__2024__Israel-Hamas_War_Spotlight_Shaking_the_Rust_Off_SysJoker_-_Check_Point_Research.pdf

Check Point Research details the evolution of the SysJoker backdoor—including a Rust-based rewrite—and documents multiple Windows variants, their persistence and C2 mechanisms (OneDrive-hosted encrypted C2 URLs, WMI StdRegProv registry usage), observed use in targeted 2023 attacks against Israeli organizations attributed to a Hamas-affiliated APT, ties to an earlier Operation Electric Powder campaign, and supplies IOCs and detection guidance.