Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor’s Repository

Unit 42 analyzes a targeted phishing campaign against a US government organization, uncovering a repository hosting dozens of malware payloads on subaat.com and linking the activity to the actor 'Subaat' referenced on HackForums, with connections to multiple malware families and IP/domain infrastructure, offering IOCs and context to aid defender response.