VERY IMPORTANT

FortiGuard Labs came across an interesting tweet from the security researcher @h4ckak about a suspicious file that looks to be a decoy file in an APT campaign. We dug deeper and found that this file might be part of a new BadPatch campaign. BadPatch is a tag used for a set of malware that was used in a campaign with a possible link to the Gaza hackers group which was first reported in 2017. This group has been involved in an espionage campaign targeting the Middle East since 2012 based on the compilation timestamp of the first malware discovered. Since then, BadPatch has gone off our radar for almost two years.