Molerats
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 20 attack patterns (mitre), 17 malware, 2 sectors, 1 countries, 37 indicators
Aliases
Operation Molerats Gaza Cybergang
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Attack patterns (MITRE) (20)
-
T1059.007 usesJavaScript MITRE
-
T1140 usesDeobfuscate/Decode Files or Information MITRE
-
T1053.005 usesScheduled Task MITRE
-
T1555.003 usesCredentials from Web Browsers MITRE
-
Compression uses
-
T1102 usesWeb Service MITRE
-
T1547.001 usesRegistry Run Keys / Startup Folder MITRE
-
T1566.001 usesSpearphishing Attachment MITRE
-
T1059.005 usesVisual Basic MITRE
-
T1036 usesMasquerading MITRE
-
T1027 usesObfuscated Files or Information MITRE
-
T1218.007 usesMsiexec MITRE
Malware (17)
-
BarbWire usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Micropsia usesFamily The MITRE Corporation Confidence 100
[Micropsia](https://attack.mitre.org/software/S0339) is a remote access tool written in Delphi.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
First seen 01/01/1970 · Last seen 16/11/5138 · -
LastConn usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DustySky usesFamily The MITRE Corporation Confidence 100
[DustySky](https://attack.mitre.org/software/S0062) is multi-stage malware written in .NET that has been used by [Molerats](https://attack.mitre.org/groups/G0021) since May 2015. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Big Bang usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
WIRTE usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PyMicropsia usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pierogi usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PoisonIvy usesFamily The MITRE Corporation Confidence 100
[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)
First seen 01/01/1970 · Last seen 16/11/5138 · -
DropBook usesFamily The MITRE Corporation Confidence 100
[DropBook](https://attack.mitre.org/software/S0547) is a Python-based backdoor compiled with PyInstaller.(Citation: Cybereason Molerats Dec 2020)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Spark usesFamily The MITRE Corporation Confidence 100
[Spark](https://attack.mitre.org/software/S0543) is a Windows backdoor and has been in use since as early as 2017.(Citation: Unit42 Molerat Mar 2020)
First seen 01/01/1970 · Last seen 16/11/5138 · -
SharpStage usesFamily The MITRE Corporation Confidence 100
[SharpStage](https://attack.mitre.org/software/S0546) is a .NET malware with backdoor capabilities.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Government targets
-
Defense ministries (including the military) targets
Countries (1)
-
Israel targets
Indicators (37)
-
stix 100/100 Revoked
SHA256 of 5e46151df994b7b71f58556c84eeb90de0776609
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
SHA256 of 5fcc262197fe8e0f129acab79fd28d32b30021d7
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
SHA256 of 694fa6436302d55c544cfb4bc9f853d3b29888ef
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
SHA256 of f3e99ec389e6108e8fda6896fa28a4d7237995be
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
Win32:TrojanX-gen\ [Trj] SHA256 of 708f05d39df7e47aefc4b15cb2db9f26bc9fad5f
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
TA401 SHA256 of 745657b4902a451c72b4aab6cf00d05895bbc02f
· Valid until 18/03/2025 · Source: AlienVault -
stix 100/100 Revoked
SHA256 of da96a8c04edf8c39d9f9a98381d0d549d1a887e8
· Valid until 18/03/2025 · Source: AlienVault -
porthopeminorhockey.netindicatesstix 100/100 Revoked· Valid until 09/10/2024 · Source: AlienVault