DNSpionage Campaign Targets Middle East

Cisco Talos discovered the DNSpionage campaign targeting Lebanon and the UAE that distributed malicious Office documents with macros to install a remote administration tool capable of DNS tunneling and HTTP C2, and separately used DNS hijacking/redirection (with attacker-created Let's Encrypt certificates) against government and airline domains; the report includes malware analysis, IOCs (domains, IPs, hashes), victimology, and mitigation guidance.