Loading malware…
MoleNet is a Windows downloader associated with the Molerats threat group, also known as the Gaza Cybergang, an Arabic-speaking espionage actor active in the Middle East. It has been used alongside other Molerats malware families including SharpStage and DropBook in politically themed intrusion campaigns targeting entities in the Palestinian Territories, the UAE, Egypt, Turkey, and other regional victims, with an apparent emphasis on political figures and government officials.
MoleNet functions as a staging component that enables follow-on compromise by downloading additional payloads and supporting arbitrary code execution on infected systems. In Molerats operations it has been used in conjunction with backdoors and additional tooling to collect system information and facilitate theft of sensitive data for exfiltration. Reported behavior includes use of PowerShell for persistence and use of Windows Management Instrumentation for host reconnaissance, including checks for firewall and antivirus products. It can establish persistence through Windows autorun mechanisms such as Registry Run keys.
Campaigns involving MoleNet have relied on phishing lures and user execution, including politically themed documents, malicious links, and archive-based delivery. The broader Molerats tradecraft around this malware family has also involved abuse of legitimate online platforms and cloud services for staging, command-and-control, and exfiltration. MoleNet is best characterized as part of a modular espionage toolset used to gain footholds, profile victim environments, and deliver additional malware in targeted Middle East-focused operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MoleNet Downloader: Hashes (SHA-256 + SHA-1) ... Domains exchangeupdates[.]com URLs https://exchangeupdates[.]com/enterprise/Senterprise.php https://exchangeupdates[.]com/enterprise/Wenterprise.php
12 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
Several entries refer generically to command-line interfaces, shell commands, scripting engines, or script execution without always specifying the exact interpreter.
AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A downloader used in the Molerats campaign to deliver additional espionage tooling and payloads as part of targeted attacks in the Middle East.
Downloader malware associated with Molerats and the listed exchangeupdates[.]com infrastructure.
Backdoor/tool used by Molerats for persistence and system information collection.
Malware that uses PowerShell for persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.