The stealthy & elusive WIRTE threat group has been seen in a government-targeting campaign operation which has been conducting attacks since 2019. Primarily WIRTE targets high-profile public and private entities throughout the Middle East, however researchers have seen activity from the threat group in surrounding regions. These threat actors will usually target entities in a variety of sectors including financial, government, law firms, military organizations, and technology. WIRTE utilized a phishing campaign loaded with malicious macro-enabled Excel documents that, once downloaded, execute malicious payloads to the current device. These payloads then gather information such as all local drives, anti-virus software discovery, user administrative rights, all running services, registry keys, and device screenshots. Additionally, WIRTE also deploys scripts to establish a connection with the threat actors command-and-control server(s) (C2) based out of Ukraine and Estonia. CTAPT will continue to monitor activity and developments surrounding the threat group and provide additional updates accordingly.