Loading story…
Securelist reported on activity attributed to the Gaza cybergang, describing an intrusion campaign that targeted victims while highlighting poor incident response and operational security among those affected. The reporting tied the group to malware-enabled espionage activity and showed how compromised organizations struggled to detect, contain, and investigate the intrusion in a timely manner.
The case underscored how attackers can maintain access when defenders lack mature IR processes, visibility, and coordinated remediation. Securelist’s account framed the campaign as both a threat intelligence finding and a warning that weak detection and response capabilities can allow relatively unsophisticated threat actors to persist inside victim environments.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks analyzed targeted attacks against regional government interests involving the Downeks downloader and a heavily modified Quasar RAT, linking the activity to the DustySky campaign that others had attributed to the Gaza Cybergang. The report also disclosed extensive malware and infrastructure details and noted the Quasar server code was itself vulnerable to remote code execution.
Securelist published a research article titled "Gaza cybergang, where’s your IR team?" documenting activity associated with the Gaza cybergang. No additional event details are available from the provided reference content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 138 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
The **Molerats** threat group, also known as the **Gaza cybergang**, conducted sustained cyber-espionage operations against organizations in the Middle East using targeted phishing campaigns that delivered remote-access malware including **Poison Ivy** and the multi-stage **DustySky** implant. The activity was described as politically motivated intelligence gathering and relied on recurring waves of malicious emails crafted in **Hebrew, Arabic, or English** to match the intended victims. Targets included **government and diplomatic institutions, aerospace and defense companies, financial organizations, journalists, and software developers**, with most victims located in **Israel, Egypt, Saudi Arabia, the United Arab Emirates, and Iraq**. Reporting indicates the group’s operations evolved over time from earlier Poison Ivy-based intrusions to the later **DustySky** campaign, while also reaching victims in the **United States and Europe** beyond its primary Middle East focus.
Aug 15, 2026
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026