WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage Backdoor

The WIRTE APT group, also tracked as Ashen Lepus by Palo Alto Networks, has been conducting espionage campaigns against government and diplomatic entities in the Middle East since 2020. The threat actor uses a previously undocumented malware suite called AshTag, delivered through AshenLoader sideloading techniques. This represents an ongoing advanced persistent threat targeting critical government infrastructure in the region.