![](https://webcf.waybackmachine.org/web/20211129092929im_/https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/11/26150139/sl-abstract-excel-label-800x450.jpg)
WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019
In this report we provide details on a malicious VBS implant distributed via MS Excel droppers and a fake “Kaspersky Update Agent” which we attribute to WIRTE APT who may be linked to Gaza Cybergang.