DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware

Introduction

In February 2024, we discovered a new malware campaign targeting government entities in the Middle East. We dubbed it “DuneQuixote”; and our investigation uncovered over 30 DuneQuixote dropper samples actively employed in the campaign. These droppers, which exist in two versions – regular droppers and tampered installer files for a legitimate tool named “Total Commander”, carried malicious code to download an additional payload in the form of a backdoor we call “CR4T”. While we identified only two CR4T implants …

campaign dropper droppers east entities february february 2024 files government government entities installer introduction investigation malware malware campaign middle east regular targeting uncovered