Threats Feed
- Public
Mahdi (Madi) Malware Campaign Targets Middle Eastern Governments and Infrastructure
Seculert researchers uncovered a sustained spear-phishing campaign dubbed Mahdi, which relied on malicious Word document attachments delivering a simple malware dropper alongside decoy content related to Iran–Israel electronic warfare. The malware communicated with command-and-control servers using disguised, Google-like web pages, with payload modules Base64-encoded inside HTML. Analysis revealed Farsi language artifacts and Persian calendar dates, suggesting an Iranian nexus. Variants were active from at least December 2011, initially hosted in Iran and later in Canada. The campaign targeted critical infrastructure companies, financial services, and government embassies across Iran, Israel, and other Middle Eastern countries, compromising more than 800 victims over eight months.
read more about Mahdi (Madi) Malware Campaign Targets Middle Eastern Governments and Infrastructure - Public
Madi Espionage Campaign Targets Middle Eastern Governments and Critical Sectors
The Madi campaign is a long-running cyber espionage operation that has been active for nearly a year, targeting individuals and organizations primarily across Iran, Israel, Afghanistan, and other countries worldwide. The attackers relied on basic but effective social engineering techniques, including spearphishing emails with malicious PowerPoint slide shows and executables disguised using Right-to-Left Override (RTLO) filenames. Once executed, the Delphi-based malware enabled extensive surveillance through keylogging, screenshot capture, audio recording, and large-scale data theft. Victims included government agencies, critical infrastructure engineering firms, financial institutions, academia, and selected individuals whose communications were monitored over extended periods.
read more about Madi Espionage Campaign Targets Middle Eastern Governments and Critical Sectors - Public
Madi Trojan Campaign Uses Social Engineering to Target Energy and Government Sectors
Symantec Security Response has identified Madi, a Trojan used in targeted social engineering campaigns observed since December 2011. The attacks relied on phishing emails carrying malicious PowerPoint attachments that prompted victims to manually execute an embedded file. Once installed, Trojan.Madi enabled information theft, including keylogging, and supported self-updating capabilities. The malware communicated with command-and-control servers hosted primarily in Iran and later Azerbaijan. Targets spanned multiple sectors, including oil and energy companies, government agencies, a foreign consulate, and US-based think tanks. While victims were concentrated in Middle Eastern countries such as Iran, Israel, and Saudi Arabia, infections were also observed globally, from the United States to New Zealand. The campaign relied entirely on social engineering rather than exploits or zero-day vulnerabilities.
read more about Madi Trojan Campaign Uses Social Engineering to Target Energy and Government Sectors