Palo Alto Ashen Lepus DEC 2025

The AshTag AshenOrchestrator component payload as been Base64 encoded and embedded with HTML content from the C2 server.

WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.

AshTag has masqueraded as a legitimate VisualServer utility.

AshTag has exfiltrated reconnaissance data on targeted systems to C2 servers.

WIRTE has exfiltrated collected victim data to C2 infrastructure.

AshTag can use a .NET program to execute WMI queries and send unique victim IDs to C2.

AshTag can set persistence using scheduled tasks.

The AshTag AshenOrchestrator component has process management functionality.

AshTag can use JSON files to deliver payloads and configuration files.

AshTag can use HTTP to send and receive data from C2.

WIRTE has staged collected documents of interest in `C:\Users\Public folder`.

The AshTag loader and AshenOrchestrator components can collect reconnaissance data from victim machines.

The AshTag AshenOrchestrator component can enumerate files on victim hosts.

AshTag can download malicious payloads from file sharing services.

The AshTag stager component can retrieve and execute the main payload.

The AshTag AshenOrchestrator component has the ability to take screenshots.

WIRTE has collected documents from victims' email accounts.

The AshTag stager compoment can decode and decrypt Base64 and XOR-encrypted payloads.

AshTag has been executed through victims downloading and opening malicious RAR archive files.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

WIRTE has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments.

AshTag has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.

WIRTE has registered domains designed to mimic legitimate sites for use in phishing campaigns.

WIRTE has obtained and used Empire and Rclone for post-exploitation activities.

WIRTE has directed victims to malicious payloads staged on file sharing services.

AshTag can check geolocation on targeted systems.

AshTag can use a set sleep time to delay C2 beaconing.

AshTag can use `volumeserialnumber` to enumerate volumes.