Moonlight – Targeted attacks in the Middle East

Vectra Threat Labs describes the 'Moonlight' campaign: a politically motivated targeted malware operation focused on Middle Eastern victims that uses social-engineered lures and impersonated news/media pages to deliver RATs (notably obfuscated H-Worm and njRat). The report documents victim distribution, deployment scripts, command-and-control domains, and hundreds of sample hashes and domains as IOCs, concluding the actors are low in technical sophistication but capable of impactful espionage.