apt

WIRTE

active · last signal 2y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Ashen LepusGaza Cybergang subgroup

Attribution

Palestinian — assessed Hamas-affiliated (Gaza Cybergang subgroup)

Origin

Palestinian Territories

First seen

2018

Last active

2025

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Palestinian Authority, Jordan, Iraq, Egypt, Saudi Arabia (per Check Point's specific victim list); Lebanon, Syria, Turkey, Armenia, Cyprus (per Securelist's broader campaign list)

Sectors

Diplomatic, financial, military, legal, technology, government

MITRE ATT&CK

G0090 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Palestinian Authority, Jordan, Iraq (Diplomatic, financial, military sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Cl0pactorTechnique overlap
SideWinderactorTechnique overlap
Gaza Cybergang / MoleratsactorTechnique overlap
MuddyWateractorTechnique overlap
Dust SpecteractorTechnique overlap
APT39 / ChaferactorTechnique overlap
APT33actorTechnique overlap
BahamutactorTechnique overlap
OilRig (APT34)

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Related cluster — overlap, not the same actor

Gaza Cybergang / Moleratsmedium confidencesource ↗WIRTE shows tooling/targeting overlap with the Molerats / Gaza Cybergang cluster (Proofpoint), tracked as a related-cluster edge rather than a merge.

Subgroup of

Gaza Cyberganghigh confidencesource ↗WIRTE (G0090) is a distinct Hamas-affiliated cluster operating as a subgroup within the Gaza Cybergang umbrella; the umbrella actor entity is deferred, so the target is a label for now.

Charming Kitten / APT42actorTechnique overlap

HEXANE (Lyceum)actorTechnique overlap

Tropic TrooperactorTechnique overlap

Scarred Manticore (Storm-0861)actorTechnique overlap

Void Manticore (Storm-0842)actorTechnique overlap

Infy / Prince of PersiaactorTechnique overlap

Imperial Kitten (CURIUM)actorTechnique overlap

Qilin (fka Agenda)actorTechnique overlap

Rocket KittenactorTechnique overlap

Earth BogleactorTechnique overlap

GreenbugactorTechnique overlap

UNC1549 / TA455actorTechnique overlap

miniFlame (SPE)actorTechnique overlap

Syrian Electronic ArmyactorTechnique overlap

Dark CaracalactorTechnique overlap

MedusaactorTechnique overlap

BladedFelineactorTechnique overlap

Stealth FalconactorTechnique overlap

UNC1860actorTechnique overlap

Sea TurtleactorTechnique overlap

Fox KittenactorTechnique overlap

LockBit / LockBit 3.0actorTechnique overlap

Gaza Cybergang Unified Front Targeting Hamas OppositionreportORKL2023-12-18

Uses

Deobfuscate/Decode Files or InformationtechniqueATT&CK mapping
Match Legitimate Resource Name or LocationtechniqueATT&CK mapping
Visual BasictechniqueATT&CK mapping
Spearphishing LinktechniqueATT&CK mapping
Native APItechniqueATT&CK mapping

+21 more relationships — see the relationships browser.

Typed relationships

Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.

Related cluster — overlap, not the same actor

Gaza Cybergang / Moleratsmedium confidencesource ↗WIRTE shows tooling/targeting overlap with the Molerats / Gaza Cybergang cluster (Proofpoint), tracked as a related-cluster edge rather than a merge.

Subgroup of

Gaza Cyberganghigh confidencesource ↗WIRTE (G0090) is a distinct Hamas-affiliated cluster operating as a subgroup within the Gaza Cybergang umbrella; the umbrella actor entity is deferred, so the target is a label for now.