VERY IMPORTANT

Proofpoint researchers recently observed new activity by the Iran-aligned threat actor TA450, known for targeting Israeli entities, in which the group used a pay-related social engineering lure to target Israeli employees at large multinational organizations. In the phishing campaign, TA450 sent emails with PDF attachments containing malicious links leading to the download of remote administration software known to be abused by TA450. This activity continues TA450's trend of leveraging Hebrew language lures and compromised Israeli accounts to target individuals at companies with an Israeli footprint.