Files packaged with Excel-DNA from which a dll containing 2 urls pointing to Discord is extracted. These download data files and encode them with XOR creating additional DLLs, which initiate the malware infection.
Iran’s new strategy in Deir Ezzor moves from recruiting to medicine, especially Rivotril
Iran, to expand its presence in Syria, has adopted a new strategy, which affects various sectors. First of all, several recruitment campaigns were launched in Dier Ezzor and East of Aleppo. Their common denominator is benefits that attract the local population, such as free access to medical care at facilities used by pro-Tehran and others. This is also thanks to the fact that, especially to Mayadeen and Abu Kamal, the Islamic Republic has sent several shipments of medicines. Some of these, however, are produced directly on site and in any case have competitive prices compared to the products traditionally sold in pharmacies. The most famous is “Rivotril”, an anxiolytic sold without prescription as an anti-pain reliever. The side effect, not communicated, is that it causes strong addiction like a narcotic. Not surprisingly, Shiite groups advertise it and facilitate its availability.
The military expansion of Shiite groups in Syria is also targeting Raqqa, Aleppo and Homs
The other pillar of Iranian expansion into Syria is purely military. The pro-Iranian militia bases in Deir Ezzor recently received new weapons and some short and medium range missiles. The supply came from Iraq, via al-Sekak. The cargo was destined for groups in the province and those east of Raqqa. In Aleppo, on the other hand, at least one new base has arisen (on the Habbouba hill) and there are logistical movements. Finally, in Homs, a Shiite para-military group garrison was set up near the T4 air base. The official excuse is that advanced platforms are needed from which to launch operations to dismantle the Islamic State’s pockets in the Badia desert.
In Hasaka, Rif Dimashq and Ghouta the levers are commercial. From construction contracts to real estate purchase campaigns
In Hasaka and Rif Dimashq, however, the pro-Iran militias have adopted a different strategy. In the first case, the PFK company was used to sign a contract with the Ministry of Water Resources, linked to the installation of four de-salinizers, intended to provide drinking water in the city of Kurdistan. This allowed Tehran’s technicians to establish themselves in the region in full legitimacy. Finally, in the second, the Shiite groups operating in the area have launched a massive campaign to buy land on the border with Lebanon. Especially in Al-Zabadani and Al-Tufayl. In addition, there is a constant acquisition of luxury apartments and villas in Budlan. The same goes for East Ghouta, where pro-Iran forces are however exploiting a local intermediary, “Abu Yasser al-Bakary”. The places most involved are Zabdin, Deir al-Assafir, Hatitet al-Turkman, al-Meliha. Moreover, commercial premises, parks and buildings damaged or destroyed by previous conflicts are also purchased.