Moonlight – Targeted attacks in the Middle East

Vectra Threat Labs describes the "Moonlight" campaign: a targeted, espionage-motivated operation against Middle Eastern entities that uses social-engineered decoy documents delivered via shortened URLs and impersonated news sites to deploy obfuscated H-Worm as a first-stage backdoor and follow-on payloads such as njRat; the report includes deployment scripts, C2 domains, sinkhole findings, victim distribution, and extensive IoCs (domains and MD5 hashes) to aid detection and response.