Midv-279 May 2026

MIDV‑279 – Technical Overview & Threat Assessment

Prepared for: Cyber‑Security Operations & Incident‑Response Teams
Date: 15 April 2026

Studies on MIDV-279 have shed light on the genetic diversity of MERS-CoV. The isolate showed several unique genetic mutations compared to other known MERS-CoV strains. These findings were crucial for understanding how the virus evolves over time and how it might be transmitted between individuals and potentially between species. MIDV-279

Multiple intelligence sources (Mandiant, FireEye, and a private Turkish CERT) converge on APT‑34 (Charming Kitten) as the likely operator. The group’s typical objectives—intelligence‑gathering, financial theft, and strategic positioning in the Middle East—align with the observed victim profile. The use of a custom C2 infrastructure and self‑signed certificates mirrors tactics seen in their 2023 campaign “SilkRoad”.

Motivation appears to be strategic espionage coupled with opportunistic financial gain (e.g., ransomware extortion after data exfiltration). The dual‑use of cloud services for exfiltration suggests an intent to blend with legitimate traffic and avoid detection. Studies on MIDV-279 have shed light on the

| Technique | Recommended Tooling | |-----------|----------------------| | Behavioral monitoring – Detect PowerShell with encoded commands, WMI event consumers, and scheduled‑task creation. | Microsoft Defender for Endpoint, CrowdStrike Falcon, Carbon Black Cloud | | Memory forensics – Hunt for reflective DLL injections and process ghosting signatures. | Volatility 3 plugins (windows.pslist, windows.dlllist, windows.malfind) | | EDR rule – Alert on CreateProcess with parent powershell.exe and child svchost.exe where the image hash does not match the legitimate binary. | SentinelOne, Elastic Endpoint Security |

| Type | Indicator | Context | |------|-----------|---------| | Domain | *.m5x.io (fast‑flux, TTL ≤ 300 s) | Primary C2 | | IP | 185.62.215.112 (Netherlands) | Beacon server | | File Hash | SHA‑256: 9F2C7E9A5D4B1E8C6F3A9D5E7B2C1A0F3E4D5C6B7A8E9F0D1C2B3A4D5E6F7A8B | PowerShell loader (encoded) | | Process Name | svchost.exe (ghosted, PID > 2000) | Core execution | | Scheduled Task | MIDV-279-Task (action: powershell.exe -EncodedCommand …) | Persistence | | Registry | HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MIDV279 → C:\Windows\System32\svchost.exe (ghosted) | Alternate persistence | | Email Subject | “Invoice # %RAND% – Urgent Review” | Typical phishing lure | | Attachment Name | Quarterly_Report_%DATE%.docm | Macro‑enabled doc | WMI event consumers

NOTE: IOCs evolve rapidly; threat‑intel feeds should be consulted for the latest hashes, domains, and IPs.