Caramel_Tsunami__2021__Strategic_web_compromises_in_the_Middle_East_with_a_pinch_of_Candiru_WeLiveSecurity.pdf

ESET documents two waves of targeted watering-hole compromises affecting high-profile Middle Eastern sites (notably Yemen and related organizations) where attacker-controlled domains injected fingerprinting JavaScript to identify Windows/macOS browser visitors and likely redirect select targets to browser exploits; the report provides technical artifacts, many C2 domains/IPs and malware/document IoCs, links to Candiru and Karkadann, and MITRE ATT&CK mappings.