apt

Gauss

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Gauss

Attribution

Nation-state — assessed U.S./Israel-linked, Flame-related platform (circumstantial on sponsor; no MITRE Group ID)

Origin

United States

First seen

2011

Last active

2012

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Lebanon, Israel, Palestinian Territories

Sectors

Banking/finance, government

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Lebanon, Israel, Palestinian Territories (Banking/finance, government sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

OilRig (APT34)actorTechnique overlap

Uses

Steal Web Session CookietechniqueATT&CK mapping
Browser Information DiscoverytechniqueATT&CK mapping
Credentials from Password Stores: Credentials from Web BrowserstechniqueATT&CK mapping
Replication Through Removable MediatechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Gauss's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

4 / 5

Mean robustness (of covered)

Useful?