Molerats
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 20 attack patterns (mitre), 17 malware, 2 sectors, 1 countries, 37 indicators
Aliases
Operation Molerats Gaza Cybergang
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Attack patterns (MITRE) (20)
-
T1059.007 usesJavaScript MITRE
-
T1140 usesDeobfuscate/Decode Files or Information MITRE
-
T1053.005 usesScheduled Task MITRE
-
T1555.003 usesCredentials from Web Browsers MITRE
-
Compression uses
-
T1102 usesWeb Service MITRE
-
T1547.001 usesRegistry Run Keys / Startup Folder MITRE
-
T1566.001 usesSpearphishing Attachment MITRE
-
T1059.005 usesVisual Basic MITRE
-
T1036 usesMasquerading MITRE
-
T1027 usesObfuscated Files or Information MITRE
-
T1218.007 usesMsiexec MITRE
Malware (17)
-
BarbWire usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Micropsia usesFamily The MITRE Corporation Confidence 100
[Micropsia](https://attack.mitre.org/software/S0339) is a remote access tool written in Delphi.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
First seen 01/01/1970 · Last seen 16/11/5138 · -
LastConn usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DustySky usesFamily The MITRE Corporation Confidence 100
[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Big Bang usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
WIRTE usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PyMicropsia usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pierogi usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PoisonIvy usesFamily The MITRE Corporation Confidence 100
[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)
First seen 01/01/1970 · Last seen 16/11/5138 · -
DropBook usesFamily The MITRE Corporation Confidence 100
[DropBook](https://attack.mitre.org/software/S0547) is a Python-based backdoor compiled with PyInstaller.(Citation: Cybereason Molerats Dec 2020)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Spark usesFamily The MITRE Corporation Confidence 100
[Spark](https://attack.mitre.org/software/S0543) is a Windows backdoor and has been in use since as early as 2017.(Citation: Unit42 Molerat Mar 2020)
First seen 01/01/1970 · Last seen 16/11/5138 · -
SharpStage usesFamily The MITRE Corporation Confidence 100
[SharpStage](https://attack.mitre.org/software/S0546) is a .NET malware with backdoor capabilities.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Government targets
-
Defense ministries (including the military) targets
Countries (1)
-
Israel targets
Indicators (37)
-
stix 100/100 Revoked
SHA256 of 4dcdb7095da34b3cef73ad721d27002c5f65f47b
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
ALFPER:DropItOutBrowse.A2 SHA256 of ee899ae5de50fdee657e04ccd65d76da7ede7c6f
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
SHA256 of 26fe41799f66f51247095115f9f1ff5dcc56baf8
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
RAR_Archive SHA256 of 60480323f0e6efa3ec08282650106820b1f35d2f
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
Unknown APT SHA256 of 599cf23db2f4d3aa3e19d28c40b3605772582cae
· Valid until 18/03/2025 · Source: AlienVault