Experts from Cybaze/ Yoroi Zlab spotted a new sample of the Karkoff implant that was employed in past campaigns associated with Iran-linked APT34 group. The new implant implements a new reconnaissance logic in order to drop the final payload only to specific targets, gathering system information, the domain name, hostname and running Operating System. The APT group made some changes in its technique, tactics, and procedures, but the target is the same, the Lebanon Government.”]
Source: https://securityaffairs.co/wordpress/98802/apt/karkoff-malware-lebanon.html