Loading malware…
SameCoin is a custom destructive malware family used in 2024 against Israeli organizations and attributed to activity linked to WIRTE, a Hamas-affiliated threat cluster associated with the broader Gaza Cybergang and overlapping reporting on TA402. It represents WIRTE’s expansion from primarily regional espionage into targeted sabotage operations against Israel.
SameCoin has been observed in at least two attack waves in February and October 2024. Delivery was conducted through phishing-style campaigns using themed lures and archive attachments, including impersonation of trusted Israeli organizations and resellers. Reported targets included Israeli hospitals, municipalities, and other entities. The malware family is described as multi-platform, with Windows and Android variants reported.
On Windows, observed SameCoin components included a destructive wiper and an infector module. The wiper overwrites victim files outside protected directories with random data, while excluding certain filenames from destruction. The malware also includes environment-validation logic intended to ensure execution against Israeli victims, using a network-based check to confirm the target context before activation. In the October 2024 campaign, the infector component was reported to support internal propagation through Outlook-delivered attachments and Active Directory scheduled-task abuse, indicating an ability to spread within an organization before or during destructive execution.
Researchers also reported code overlap between SameCoin and newer WIRTE tooling, including an encryption or XOR-related function shared with an IronWind loader variant, supporting assessment of common development and operational linkage. Campaigns associated with SameCoin also incorporated propaganda elements aligned with Hamas messaging, reinforcing the political and psychological dimension of the operations.
SameCoin is best characterized as a politically motivated wiper used for disruptive attacks against Israeli entities, distinct from WIRTE’s parallel espionage activity across the Middle East. Its deployment illustrates a dual-use operational model in which the same actor conducts intelligence collection regionally while reserving destructive malware for selected Israeli targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2024, however, Check Point observed WIRTE employing SameCoin, a custom wiper malware, to attack Israeli entities in February and October.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a recently discovered wiper.
Destructive wiper used in WIRTE-linked operations (including activity branded as 'Cyber Toufan Al-Aqsa').
Destructive wiper malware used in WIRTE-linked operations (including activity associated with 'Cyber Toufan Al-Aqsa').
SameCoin is a custom wiper malware used by the WIRTE/APT group for destructive attacks, particularly targeting Israeli entities, to destroy data as part of sabotage operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.