Loading threat actor…
Molerats, also referred to as Gaza Cybergang, Operation Molerats, TA402, WIRTE, and Ashen Lepus, is a suspected Hamas-aligned threat cluster active since at least 2012. The group is primarily focused on intelligence collection and espionage. Reporting in the provided content states that it primarily targets Palestinian entities and Israel, with broader activity across the Middle East and less-observed targeting in the EU and US. Targeted sectors include government, defense, energy, financial, media, technology, telecommunication, and civil society. The content describes Molerats/Gaza Cybergang as relying heavily on spearphishing and social engineering for initial access, including phishing emails with malicious Microsoft Word and PDF attachments, malicious links, archives, and documents that trick users into enabling macros or content. WIRTE-related activity used look-alike domains and graphics of trusted security solution providers to entice victims to click phishing links. The group has used malicious files delivered by email, embedded macros, and weaponized Office documents, often with Base64-encoded payloads. Observed techniques in the content include PowerShell execution, HTTP network communication, Base64 decoding of malicious VBS scripts, decompression of ZIP archives on victim machines, malicious file execution, and persistence via files placed in AppData and Startup folders. The content also notes use of browser credential theft via the public tool BrowserPasswordDump10. Associated malware and tooling mentioned in the content include DustySky, DropBook, SharpStage, MoleNet, Molerat Loader, XtremeRAT, Spark, Pierogi, Pierogi++, PoisonIvy, and Micropsia-family malware. SentinelLABS reporting in the provided content describes Gaza Cybergang as a cluster of adjacent sub-groups and cites Group 1 as Molerats, Group 2 as Arid Viper/Desert Falcons/APT-C-23, and Group 3 as Operation Parliament. The content further notes overlaps and likely relations among TA402, WIRTE, and Gaza Cybergang, including shared malware staging behavior and C2 communication traits.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
34 malware families attributed to this actor across reporting.
29 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
544 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with Windows Command Shell execution behavior relevant to this detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.