Loading story…
The Molerats threat group, also known as the Gaza cybergang, conducted sustained cyber-espionage operations against organizations in the Middle East using targeted phishing campaigns that delivered remote-access malware including Poison Ivy and the multi-stage DustySky implant. The activity was described as politically motivated intelligence gathering and relied on recurring waves of malicious emails crafted in Hebrew, Arabic, or English to match the intended victims.
Targets included government and diplomatic institutions, aerospace and defense companies, financial organizations, journalists, and software developers, with most victims located in Israel, Egypt, Saudi Arabia, the United Arab Emirates, and Iraq. Reporting indicates the group’s operations evolved over time from earlier Poison Ivy-based intrusions to the later DustySky campaign, while also reaching victims in the United States and Europe beyond its primary Middle East focus.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
ClearSky says the multi-stage DustySky malware, called "NeD Worm" by its developer, has been in use since May 2015 in a Molerats campaign involving dozens of attacks and weekly phishing waves.
FireEye published reporting on Operation Molerats, describing Middle East cyber attacks using the Poison Ivy malware family.
ClearSky states that the Molerats, also known as the Gaza cybergang, have been operating since 2012 as a politically motivated intelligence-gathering group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
Escalating conflict following **Operation Epic Fury** (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned **TA453** (*Charming Kitten / Mint Sandstorm / APT42*) continued intelligence collection during the conflict, including a **credential-phishing** attempt against a US think tank observed on **8 March**, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to **China, Belarus, Pakistan, and Hamas**). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing. Check Point Research separately identified China-linked activity targeting **Qatar**, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including **PlugX** and **Cobalt Strike**, with tradecraft described as a multi-stage chain involving a compromised server and **DLL hijacking** via a legitimate application (*Baidu NetDisk*) to load the backdoor—highlighting rapid weaponization of breaking news to target **energy** and **military** sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking **‘BlackSanta’** BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).
Jun 29, 2026
Security researchers and government analysts said the Iranian state-linked **MuddyWater** group continued broad cyberespionage operations across the Middle East and nearby regions while evolving its malware and command-and-control infrastructure. Recent reporting tied the actor to a previously unreported Go-based C2 framework, **MuddyC2Go**, which appears to have replaced older **PhonyC2** infrastructure after source code leaks and has been active since at least 2020. Campaigns linked to the framework targeted a Jordanian company, an Iraqi telecommunications provider, and likely Israeli organizations, while earlier activity hit government, telecom, and intergovernmental entities in Turkey, Jordan, Iraq, Georgia, Azerbaijan, Armenia, Pakistan, and other regional states through spearphishing, malicious archives, macro-enabled Office files, PDFs, and PowerShell-heavy loaders. Across multiple campaigns, MuddyWater used a shifting toolset that included **POWGOOP**, **Canopy/Starwhale**, **Mori**, **ForeLord**, **POWERSTATS**, **Covicli**, lightweight VBS first-stage malware, DNS-tunneling RATs, ASP.NET web shells, and tunneling utilities such as **SSF** and **Ligolo**. Analysts also linked the group to exploitation of **`CVE-2020-0688`** and possible use of **`CVE-2020-1472`** in operations against Israeli targets, including an intrusion assessed as potentially destructive through deployment of PowGoop and a Thanos-based wiper-like payload disguised as ransomware. Despite changes in malware families and infrastructure, reports consistently described the actor as relying heavily on **PowerShell**, credential theft, persistence via registry keys or scheduled tasks, and rapidly changing C2 servers, underscoring a sustained Iranian espionage capability with occasional escalation toward disruptive effects.
Aug 15, 2026