人面狮行动

APTooperation named '人面狮行动' (Human Lion Operation) active in the Middle East uses social-network watering hole attacks and lure documents to drop a modular backdoor (ROCK) composed of multiple DLLs that injects into processes, exfiltrates sensitive data, and communicates with C2 servers over HTTP; the operation, potentially developed by a regional threat actor, has extensive documentation including sample counts, PDB paths, observer accounts, and related malware like njRAT, with evidence of targeted activity against Egyptian and Israeli entities and a sophisticated anti-analysis stack.