Molerats__2022__Zscaler_Molerats-APT-targeting-Middle-East_01-20-2022.pdf

Zscaler ThreatLabz describes a targeted espionage campaign by the Molerats APT (July–Dec 2021) using macro-laden Office documents and PowerShell to drop a ConfuserEx/Themida-protected .NET backdoor that communicates with attacker-controlled Dropbox accounts for C2 and file exfiltration; the report includes static/dynamic analysis, C2/TTP mapping, extensive IOCs (hashes, IPs, domains, cloud accounts) and observed victim profiles in the Middle East.