SpearSpecter: Sophisticated Cyber-Espionage Campaign Targets High-Value Officials

Researchers from the Israel National Digital Agency (INDA) have uncovered a sophisticated cyber-espionage campaign named SpearSpecter. The campaign, linked to state-aligned threat actors, uses social engineering and a fileless PowerShell backdoor called TAMECAT to target high-value government and defense officials. The attackers build trust over weeks through WhatsApp conversations before delivering malicious links disguised as conference documents. The malware leverages legitimate cloud infrastructure and employs multi-channel command-and-control frameworks, including Telegram and Discord. TAMECAT's capabilities include data exfiltration, credential harvesting, and screenshot capture. The campaign demonstrates a deep understanding of Windows internals and human behavior, representing a significant escalation in cyber-espionage tradecraft.