Molerats

Molerats, also referred to in the content as Gaza Cybergang, WIRTE, TA402, Operation Molerats, and Ashen Lepus, is a suspected Hamas-aligned threat cluster active since at least 2012. The group is assessed as primarily focused on intelligence collection and espionage. Reported targeting is concentrated across the Middle East, especially Palestinian entities and Israel, with additional less-observed activity in the EU and US. Targeted sectors mentioned in the content include government, defense, energy, financial, media, technology, telecommunication, and civil society. The content describes Molerats/Gaza Cybergang as favoring spearphishing and other social engineering for initial access. Observed delivery methods include phishing emails with malicious Microsoft Word and PDF attachments, malicious links, archives, and files that trick users into enabling document macros or clicking Enable Content. WIRTE is specifically described as using look-alike domains and graphics of trusted security solution providers to entice victims to click phishing links, and as using UDL-file-based spearphishing attachments. Techniques and behaviors directly mentioned include PowerShell execution, malicious file execution, ZIP decompression on victim machines, HTTP network communication, and Base64 decoding of malicious VBS scripts. The content also states that Molerats has used shared modules execution. For persistence and follow-on access, the broader Gaza Cybergang reporting in the content notes use of implants and malware families including Molerat Loader, XtremeRAT, SharpStage, DropBook, Spark, Pierogi, Pierogi++, PoisonIvy, DustySky, MoleNet, and BarbWire. The content further describes Gaza Cybergang as a cluster with adjacent sub-groups, including Group 1 Molerats, Group 2 Arid Viper/Desert Falcons/APT-C-23, and Group 3 associated with Operation Parliament. SentinelLABS is cited as assessing likely consolidation among these sub-groups based on shared victims, TTPs, malware evolution, and overlapping infrastructure. The content also notes likely relations among TA402, WIRTE, and Gaza Cybergang based on shared malware staging behavior and command-and-control traits. Additional directly mentioned activity includes use of the public tool BrowserPasswordDump10 to dump browser-saved passwords, and use of DustySky, a multi-stage malware described as being used by Molerats for intelligence gathering.