apt

Gaza Cybergang / Molerats

active · last signal 2y agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

MoleratsGaza Hackers TeamOperation MoleratsExtreme JackalMoonlightGaza CybergangFrankensteinRenegade Jackal

Attribution

Palestinian — assessed Hamas-affiliated

Origin

Palestinian Territories

First seen

2012

Last active

2025

Motivation

Espionage

Attribution confidence

high

MENA targeting

Palestinian Territories, Jordan, Israel, Lebanon, Egypt

Sectors

Diplomatic, government, NGOs, media, banking, journalists/activists, healthcare

MITRE ATT&CK

G0021 ↗

Why it mattersState-sponsored / APT actor, high confidence, documented targeting Palestinian Territories, Jordan, Israel (Diplomatic, government, NGOs sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

SideWinderactorTechnique overlap
WIRTEactorTechnique overlap
Dust SpecteractorTechnique overlap
APT33actorTechnique overlap
BahamutactorTechnique overlap
Cl0pactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
Earth BogleactorTechnique overlap
MuddyWater

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Vendor tracking name

TA402high confidencesource ↗TA402 is Proofpoint's vendor cluster name for the Molerats / Gaza Cybergang activity tracked here as gaza-cybergang-molerats (ATT&CK G0021); mapped as a crosswalk, kept visible.

APT39 / ChaferactorTechnique overlap

Rocket KittenactorTechnique overlap

HEXANE (Lyceum)actorTechnique overlap

GreenbugactorTechnique overlap

Stealth FalconactorTechnique overlap

Qilin (fka Agenda)actorTechnique overlap

OilRig (APT34)actorTechnique overlap

StrongPity (PROMETHIUM)actorTechnique overlap

Tropic TrooperactorTechnique overlap

Charming Kitten / APT42actorTechnique overlap

BladedFelineactorTechnique overlap

8BaseactorTechnique overlap

MedusaactorTechnique overlap

Imperial Kitten (CURIUM)actorTechnique overlap

Void Manticore (Storm-0842)actorTechnique overlap

Fox KittenactorTechnique overlap

LockBit / LockBit 3.0actorTechnique overlap

Israel-Hamas War in Cyber February 2024 Tool of First ResortreportORKL2024-02-08

Israel-Hamas War Spotlight: Shaking the Rust Off SysJokerreportORKL2024-01-16

Gaza Cybergang Unified Front Targeting Hamas OppositionreportORKL2023-12-18

Uses

Ingress Tool TransfertechniqueATT&CK mapping
Process DiscoverytechniqueATT&CK mapping
JavaScripttechniqueATT&CK mapping
Deobfuscate/Decode Files or InformationtechniqueATT&CK mapping
MsiexectechniqueATT&CK mapping
Registry Run Keys / Startup FoldertechniqueATT&CK mapping
PowerShelltechniqueATT&CK mapping
Malicious LinktechniqueATT&CK mapping
Spearphishing AttachmenttechniqueATT&CK mapping

+7 more relationships — see the relationships browser.

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Vendor tracking name

TA402high confidencesource ↗TA402 is Proofpoint's vendor cluster name for the Molerats / Gaza Cybergang activity tracked here as gaza-cybergang-molerats (ATT&CK G0021); mapped as a crosswalk, kept visible.