H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[AshTag](https://attack.mitre.org/software/S9031) is a modular .NET backdoor with multiple features that has been used by [WIRTE](https://attack.mitre.org/groups/G0090) since at least 2025. [AshTag](https://attack.mitre.org/software/S9031) is designed for persistence and remote command execution and can masquerade as a legitimate VisualServer utility.(Citation: Palo Alto Ashen Lepus DEC 2025)

Labels

malware

20 recorded

Relationships

uses

to Delay Execution

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Process Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Location Discovery

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Management Instrumentation

Technique

uses

from WIRTE

Group

2 external

References

mitre-attack

S9031

Palo Alto Ashen Lepus DEC 2025

https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/