Threat actors breached Comsecure, the exclusive distributor and operator of ESET’s local infrastructure in Israel, compromising official mail servers and web endpoints on the eset.co.il domain. The attackers weaponized the compromised infrastructure to launch spear-phishing campaigns targeting Israeli enterprises, defense contractors, and cybersecurity personnel. Sent directly from authenticated partner mail servers, the lures passed SPF, DKIM, and DMARC verification mechanisms, impersonating the “ESET Advanced Threat Defense Team” and warning recipients of state-sponsored threats to solicit immediate defensive action.

The phishing lures directed targets to download a ZIP archive hosted on eset.co.il purporting to be a defensive utility named “ESET Unleashed.” The archive bundled authentic, digitally signed ESET DLL libraries alongside an unsigned binary that initiated DLL search-order hijacking to execute a destructive data-wiping payload. Once invoked, the wiper enumerates local volumes, corrupts partition structures, and permanently deletes enterprise files. ESET confirmed the intrusion was isolated entirely to Comsecure’s partner environment and severed the malicious infrastructure within minutes. Threat intelligence researchers attributed the operational tradecraft and wiping malware to Iranian state-aligned threat actors, specifically the Handala persona.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Compromising authenticated partner mail infrastructure completely bypasses cryptographic email authentication (SPF/DKIM/DMARC) and brand reputation defenses. By combining trusted hostnames with DLL search-order hijacking, attackers weaponize ecosystem trust into zero-interaction inspection bypasses.
• Bullet 2 — Strategic & Defender Imperative: Organizations must isolate vendor trust boundaries, enforcing application control and strict code-signing verification regardless of source reputation. Security teams should treat third-party partner communications with explicit zero-trust verification and maintain offline, immutable disaster recovery backups against destructive wiper attacks.