Iranian threat actors from APT34 are believed to be behind a new phishing campaign intended to deliver a modernized version of the Saitama backdoor. The phishing emails contain simple one-line statements from fake Government of Jordan officials stating the user must open and fill out an attached form called “Confirmation Receive Documents.xls” to receive their pending documents. Once the user executes the malicious attachment, Excel displays the workbook where a textbox states “Press ‘Enable Editing’ then Press ‘Enable Content’ to show Content of Document.” After the macros are enabled, scripts embedded within the file execute and install the Saitama backdoor. Saitama masks its communications to threat actor endpoints by abusing the DNS protocol. Furthermore, the backdoor is configured to communicate with the command-and-control (C2) server at least once every 6-8 hours. To lessen the chance of threat actor compromise, CTIX analysts recommend users vet every email prior to executing attachments or hyperlinks within the email and that security teams establish phishing security controls for further security.