Molerats
Also reported as Gaza Cybergang, Operation Molerats, Extreme Jackal, Gaza Hackers Team, TA402 and 7 other names. Linked to Palestine by two sources.
Reports per quarter
Techniques in ATT&CK
Listed by ATT&CK
No report from the last two years names a technique ID.
CVEs named in reports
- CVE-2012-0158 KEV ransomware
- CVE-2012-5687
- CVE-2013-5947
- CVE-2014-1225
- CVE-2014-2962
- CVE-2014-4019
- CVE-2014-4114 KEV
- CVE-2014-6332 KEV
- CVE-2014-6352 KEV
- CVE-2014-8361 KEV
- CVE-2014-9583
- CVE-2015-0554
Show all 57 CVEs Show fewer
- CVE-2015-2545 KEV
- CVE-2015-7248
- CVE-2015-7254
- CVE-2017-0144 KEV ransomware
- CVE-2017-0199 KEV ransomware
- CVE-2017-0213 KEV ransomware
- CVE-2017-0262 KEV
- CVE-2017-11292 KEV
- CVE-2017-11882 KEV ransomware
- CVE-2017-6327 KEV
- CVE-2017-6328
- CVE-2017-8759 KEV
- CVE-2018-0798 KEV
- CVE-2018-0802 KEV ransomware
- CVE-2018-13379 KEV ransomware
- CVE-2018-20250 KEV ransomware
- CVE-2018-8453 KEV ransomware
- CVE-2019-0708 KEV ransomware
- CVE-2019-0803 KEV ransomware
- CVE-2019-10149 KEV
- CVE-2019-11510 KEV ransomware
- CVE-2019-15126
- CVE-2019-1652 KEV
- CVE-2019-1653 KEV
- CVE-2019-16920 KEV
- CVE-2019-19781 KEV ransomware
- CVE-2019-3396 KEV ransomware
- CVE-2019-9670 KEV
- CVE-2020-0601 KEV
- CVE-2020-0688 KEV ransomware
- CVE-2020-0796 KEV ransomware
- CVE-2020-10189 KEV
- CVE-2020-1040 KEV
- CVE-2020-1350 KEV
- CVE-2020-1472 KEV ransomware
- CVE-2020-15892
- CVE-2020-15893
- CVE-2020-15894
- CVE-2020-15895
- CVE-2020-15896
- CVE-2020-3702
- CVE-2020-5902 KEV ransomware
- CVE-2020-6789
- CVE-2020-8515 KEV
- CVE-2023-38831 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Molerats, Extreme Jackal, Gaza Cybergang
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Molerats, Extreme Jackal, Gaza Cybergang
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Poison Ivy (Malware Family)
Show all 130 reports Show fewer
-
Operation Parliament - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Operation Parliament - Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Quasar RAT (Malware Family)
-
Operation Molerats: Middle East Cyber Attacks Using Poison Ivy
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Molerats: Middle East Cyber Attacks Using Poison Ivy
-
The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest
-
Gaza Cybergang Unified Front Targeting Hamas Opposition
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Gaza Cybergang Unified Front Targeting Hamas Opposition
-
Israel-Hamas War Spotlight_ Shaking the Rust Off SysJoker - Check Point Research
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Israel-Hamas War Spotlight_ Shaking the Rust Off SysJoker - Check Point Research
-
Palestinian Hackers Use New NimbleMamba Implant in Recent Attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Palestinian Hackers Use New NimbleMamba Implant in Recent Attacks
-
Ugg Boots 4 Sale- A Tale of Palestinian-Aligned Espionage
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ugg Boots 4 Sale- A Tale of Palestinian-Aligned Espionage
-
Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage
-
Analysis of a Management IP Address linked to Molerats APT
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analysis of a Management IP Address linked to Molerats APT
-
New espionage attack by Molerats APT targeting users in the Middle East
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New espionage attack by Molerats APT targeting users in the Middle East
-
New espionage attack by Molerats APT targeting users in the Middle East
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor New espionage attack by Molerats APT targeting users in the Middle East
-
WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019
-
New TA402-MOLERATS Malware – Decrypting .NET Reactor Strings
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New TA402-MOLERATS Malware – Decrypting .NET Reactor Strings
-
New TA402 Molerats Malware Targets Governments in the Middle East
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New TA402 Molerats Malware Targets Governments in the Middle East
-
Threat Group Uses Voice Changing Software in Espionage Attempt
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Uses Voice Changing Software in Espionage Attempt
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Threat Group Uses Voice Changing Software in Espionage Attempt - Cado Security _ Cloud Native Digital Forensics
-
-Civerids- organization vs. Middle East area attack activity analysis report
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor -Civerids- organization vs. Middle East area attack activity analysis report
-
Operation Molerats: Middle East Cyber Attacks Using Poison Ivy
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Molerats: Middle East Cyber Attacks Using Poison Ivy
-
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor [HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
-
New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign
-
Group-IB_Hi-Tech_Crime_Trends_2020-2021_en
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Group-IB_Hi-Tech_Crime_Trends_2020-2021_en
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ESET_Threat_Report_Q32020
-
Welcome Chat as a secure messaging app_ Nothing could be further from the truth _ WeLiveSecurity
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Welcome Chat as a secure messaging app_ Nothing could be further from the truth _ WeLiveSecurity
-
Welcome Chat as a secure messaging app- Nothing could be further from the truth
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Welcome Chat as a secure messaging app- Nothing could be further from the truth
-
Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
-
New Cyber Espionage Campaigns Targeting Palestinians - Part 1- The Spark Campaign
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Cyber Espionage Campaigns Targeting Palestinians - Part 1- The Spark Campaign
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor New Cyber Espionage Campaigns Targeting Palestinians - Part 2_ The Discovery of the New, Mysterious Pierogi Backdoor
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Cyber Espionage Campaigns Targeting Palestinians - Part 2- The Discovery of the New, Mysterious Pierogi Backdoor
-
Alien Labs 2019 Analysis of Threat Groups Molerats and APT-C-37
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Alien Labs 2019 Analysis of Threat Groups Molerats and APT-C-37
-
The Gaza cybergang and its SneakyPastes campaign
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Gaza cybergang and its SneakyPastes campaign
-
Gaza Cybergang Group1 operation SneakyPastes
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Gaza Cybergang Group1 operation SneakyPastes
-
suspected-molerats-new-attack-in-the-middle-east-en
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor suspected-molerats-new-attack-in-the-middle-east-en
-
suspected-molerats-new-attack-in-the-middle-east-cn
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor suspected-molerats-new-attack-in-the-middle-east-cn
-
apt-attack-middle-east-big-bang
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor apt-attack-middle-east-big-bang
-
APT Attack In the Middle East- The Big Bang
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Attack In the Middle East- The Big Bang
-
BSides IR in Heterogeneous Environment
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BSides IR in Heterogeneous Environment
-
Operation Parliament, who is doing what-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Parliament, who is doing what-
-
Operation Parliament, who is doing what? - Securelist
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Parliament, who is doing what? - Securelist
-
Gaza Cybergang - updated activity in 2017_ - Securelist
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Gaza Cybergang - updated activity in 2017_ - Securelist
-
Gaza Cybergang – updated activity in 2017-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gaza Cybergang – updated activity in 2017-
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Desert Eagle
-
Operation Electric Powder - Who is targeting Israel Electric Company?
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Electric Powder - Who is targeting Israel Electric Company?
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation_Electric_Powder
-
Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
-
Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments - Palo Alto Networks Blog
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments - Palo Alto Networks Blog
-
Moonlight - Targeted attacks in the Middle East
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Moonlight - Targeted attacks in the Middle East
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation DustySky Part 2
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation DustySky Notes
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Dusty Sky
-
Mapping FinFisher’s Continuing Proliferation
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Mapping FinFisher’s Continuing Proliferation
-
Gaza cybergang, where’s your IR team-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Gaza cybergang, where’s your IR team-
-
FireEye Intelligence: Threat Landscape Overview
The original link failed its last check. Original publisher Detailsfor FireEye Intelligence: Threat Landscape Overview
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Molerats, Here for Spring!
-
XtremeRAT: Nuisance or Threat?
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor XtremeRAT: Nuisance or Threat?
-
XtremeRAT- Nuisance or Threat-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor XtremeRAT- Nuisance or Threat-
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Operation Molerats
Newest first. Details opens the report in Explore.