SYMBOLCOMMON_NAMEaka. SYNONYMS

Molerats  (Back to overview)

aka: ALUMINUM SARATOGA, BLACKSTEM, Extreme Jackal, G0021, Gaza Cybergang, Gaza Hackers Team, Gaza cybergang, Moonlight, Operation Molerats

In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. and as discovered later, even the U.S. and UK governments. Further research revealed a connection between these attacks and members of the so-called “Gaza Hackers Team.” We refer to this campaign as “Molerats.”

Associated Families
apk.badpatch win.brittle_bush win.dropbook win.extreme_rat win.molenet win.nimblemamba win.poison_ivy win.sharpstage win.spark win.pierogi win.molerat_loader
References
2023-12-14 ⋅ SentinelOne ⋅ Aleksandar Milenkoski
Gaza Cybergang | Unified Front Targeting Hamas Opposition
BarbWire Micropsia Pierogi AridViper
2023-11-22 ⋅ Twitter (@embee_research) ⋅ Embee_research
Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)
BianLian Xtreme RAT NjRAT QakBot RedLine Stealer Remcos
2022-11-30 ⋅ ⋅ FFRI Security ⋅ Matsumoto
Evolution of the PlugX loader
PlugX Poison Ivy
2022-08-22 ⋅ Fortinet ⋅ Fred Gutierrez, Shunichi Imano
A Tale of PivNoxy and Chinoxy Puppeteer
Chinoxy Poison Ivy
2022-07-31 ⋅ BushidoToken Blog ⋅ BushidoToken
Space Invaders: Cyber Threats That Are Out Of This World
Poison Ivy Raindrop SUNBURST TEARDROP WastedLocker
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Crawling Taurus
Poison Ivy APT20
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Shallow Taurus
FormerFirstRAT IsSpace NewCT PlugX Poison Ivy Tidepool DragonOK
2022-05-17 ⋅ Positive Technologies ⋅ Positive Technologies
Space Pirates: analyzing the tools and connections of a new hacker group
FormerFirstRAT PlugX Poison Ivy Rovnix ShadowPad Zupdax
2022-05-16 ⋅ JPCERT/CC ⋅ Shusei Tomonaga
Analysis of HUI Loader
HUI Loader PlugX Poison Ivy Quasar RAT
2022-02-08 ⋅ Proofpoint ⋅ Georgi Mladenov, Joshua Miller, Konstantin Klinger
Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage
BrittleBush NimbleMamba TA402
2022-02-08 ⋅ The Hacker News ⋅ Ravie Lakshmanan
Palestinian Hackers Use New NimbleMamba Implant in Recent Attacks
NimbleMamba
2022-01-20 ⋅ Zscaler ⋅ Sahil Antil, Sudeep Singh
New espionage attack by Molerats APT targeting users in the Middle East
Spark
2021-07-06 ⋅ 0ffset Blog ⋅ 0verfl0w_, Daniel Bunce
New TA402/MOLERATS Malware – Decrypting .NET Reactor Strings
SharpStage
2021-06-17 ⋅ Proofpoint ⋅ Dennis Schwarz, Konstantin Klinger, Selena Larson
New TA402 Molerats Malware Targets Governments in the Middle East
Molerat Loader
2021-06-16 ⋅ Recorded Future ⋅ Insikt Group®
Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries
Icefog PcShare PlugX Poison Ivy QuickHeal DAGGER PANDA
2021-03-17 ⋅ Recorded Future ⋅ Insikt Group®
China-linked TA428 Continues to Target Russia and Mongolia IT Companies
PlugX Poison Ivy TA428
2021-02-01 ⋅ ESET Research ⋅ Ignacio Sanmillan, Matthieu Faou
Operation NightScout: Supply‑chain attack targets online gaming in Asia
Ghost RAT NoxPlayer Poison Ivy Red Dev 17
2021-01-15 ⋅ Swisscom ⋅ Markus Neis
Cracking a Soft Cell is Harder Than You Think
Ghost RAT MimiKatz PlugX Poison Ivy Trochilus RAT
2021-01-08 ⋅ Youtube (Virus Bulletin) ⋅ Fumio Ozawa, Rintaro Koike, Shogo Hayashi
Operation LagTime IT: colourful Panda footprint
Cotx RAT nccTrojan Poison Ivy Tmanger TA428
2020-12-13 ⋅ SlideShare (ChiEnAshleyShen) ⋅ Chi-en Shen, Steve Su
From ThreatHunting to Campaign Tracking
Xtreme RAT
2020-12-09 ⋅ Cybereason ⋅ Cybereason Nocturnus Team
MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign
DropBook JhoneRAT Molerat Loader Pierogi Quasar RAT SharpStage Spark
2020-12-09 ⋅ Cybereason ⋅ Cybereason Nocturnus
New Malware Arsenal Abusing Cloud Platforms in Middle East Espionage Campaign
DropBook MoleNet Quasar RAT SharpStage Spark
2020-10-30 ⋅ YouTube (Kaspersky Tech) ⋅ Kris McConkey
Around the world in 80 days 4.2bn packets
Cobalt Strike Derusbi HyperBro Poison Ivy ShadowPad Winnti
2020-10-26 ⋅ ⋅ 360 Core Security ⋅ 360
北非狐（APT-C-44）攻击活动揭露
Xtreme RAT Houdini NjRAT Revenge RAT
2020-10-01 ⋅ US-CERT ⋅ US-CERT
Alert (AA20-275A): Potential for China Cyber Response to Heightened U.S.-China Tensions
CHINACHOPPER Cobalt Strike Empire Downloader MimiKatz Poison Ivy
2020-09-30 ⋅ NTT Security ⋅ Fumio Ozawa, Rintaro Koike, Shogo Hayashi
Operation LagTime IT: colourful Panda footprint (Slides)
Cotx RAT nccTrojan Poison Ivy Tmanger
2020-09-30 ⋅ NTT Security ⋅ Fumio Ozawa, Rintaro Koike, Shogo Hayashi
Operation LagTime IT: colourful Panda footprint
Cotx RAT nccTrojan Poison Ivy Tmanger
2020-09-16 ⋅ RiskIQ ⋅ Jon Gross
RiskIQ: Adventures in Cookie Land - Part 2
8.t Dropper Chinoxy Poison Ivy
2020-08-28 ⋅ NTT ⋅ Fumio Ozawa, Rintaro Koike, Shogo Hayashi
Operation Lagtime IT: Colourful Panda Footprint
Cotx RAT Poison Ivy TA428
2020-08-19 ⋅ NTT Security ⋅ Fumio Ozawa, Rintaro Koike, Shogo Hayashi
Operation LagTime IT: Colorful Panda Footprint
8.t Dropper Cotx RAT Poison Ivy TA428
2020-07-14 ⋅ ESET Research ⋅ Lukáš Štefanko
Welcome Chat as a secure messaging app? Nothing could be further from the truth
BadPatch
2020-03-12 ⋅ Check Point ⋅ Check Point Research
Vicious Panda: The COVID Campaign
8.t Dropper BYEBY Enfal Korlia Poison Ivy
2020-03-03 ⋅ Palo Alto Networks Unit 42 ⋅ Alex Hinchliffe, Bryan Lee, Robert Falcone
Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
Downeks JhoneRAT Molerat Loader Spark
2020-03-02 ⋅ Virus Bulletin ⋅ Alex Hinchliffe
Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary
HenBox Farseer PlugX Poison Ivy
2020-02-13 ⋅ Cybereason ⋅ Cybereason Nocturnus
New Cyber Espionage Campaigns Targeting Palestinians - Part 2: The Discovery of the New, Mysterious Pierogi Backdoor
Pierogi
2020-02-13 ⋅ Cybereason ⋅ Cybereason Nocturnus
New Cyber Espionage Campaigns Targeting Palestinians - Part 1: The Spark Campaign
Spark
2020-01-29 ⋅ nao_sec blog ⋅ nao_sec
An Overhead View of the Royal Road
BLACKCOFFEE Cotx RAT Datper DDKONG Derusbi Icefog Korlia NewCore RAT PLAINTEE Poison Ivy Sisfader
2020-01-09 ⋅ Lab52 ⋅ Jagaimo Kawaii
TA428 Group abusing recent conflict between Iran and USA
Poison Ivy
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE KEYSTONE
9002 RAT BLACKCOFFEE DeputyDog Derusbi HiKit PlugX Poison Ivy ZXShell APT17
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE UNION
9002 RAT CHINACHOPPER Enfal Ghost RAT HttpBrowser HyperBro owaauth PlugX Poison Ivy ZXShell APT27
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE FIRESTONE
9002 RAT Derusbi Empire Downloader PlugX Poison Ivy APT19
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
ALUMINUM SARATOGA
BlackShades DarkComet Xtreme RAT Poison Ivy Quasar RAT Molerats
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE RIVERSIDE
Anel ChChes Cobalt Strike PlugX Poison Ivy Quasar RAT RedLeaves APT10
2019-12-12 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center
GALLIUM: Targeting global telecom
CHINACHOPPER Ghost RAT HTran MimiKatz Poison Ivy GALLIUM
2019-11-19 ⋅ FireEye ⋅ Kelli Vanderlee, Nalani Fraser
Achievement Unlocked: Chinese Cyber Espionage Evolves to Support Higher Level Missions
MESSAGETAP TSCookie ACEHASH CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT HIGHNOON HTran MimiKatz NetWire RC POISONPLUG Poison Ivy pupy Quasar RAT ZXShell
2019-07-23 ⋅ Proofpoint ⋅ Dennis Schwarz, Michael Raggi, Proofpoint Threat Insight Team
Chinese APT “Operation LagTime IT” Targets Government Information Technology Agencies in Eastern Asia
8.t Dropper Cotx RAT Poison Ivy TA428
2019-06-25 ⋅ Cybereason ⋅ Cybereason Nocturnus
OPERATION SOFT CELL: A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS
CHINACHOPPER HTran MimiKatz Poison Ivy Operation Soft Cell
2019-04-10 ⋅ Kaspersky Labs ⋅ Kaspersky Team
The Gaza cybergang and its SneakyPastes campaign
Molerats
2019-02-14 ⋅ ⋅ 360.cn ⋅ 奇安信威胁情报中心
Suspected Molerats New Attack in the Middle East
Molerats
2019-02-14 ⋅ 奇安信威胁情报中心 ⋅ 事件追踪
Suspected Molerats' New Attack in the Middle East
Molerats
2019-01-01 ⋅ MITRE ⋅ MITRE ATT&CK
Group description: Molerats
Molerats
2019-01-01 ⋅ Virus Bulletin ⋅ Bowen Pan, Lion Gu
A vine climbing over the Great Firewall: A long-term attack against China
Poison Ivy ZXShell
2018-09-21 ⋅ Qihoo 360 Technology ⋅ Qihoo 360
Poison Ivy Group and the Cyberespionage Campaign Against Chinese Military and Goverment
Poison Ivy
2018-05-15 ⋅ BSides Detroit ⋅ Keven Murphy, Stefano Maccaglia
IR in Heterogeneous Environment
Korlia Poison Ivy
2017-10-30 ⋅ Kaspersky Labs ⋅ Ghareeb Saad, Mohamad Amin Hasbini
Gaza Cybergang – updated activity in 2017:
Molerats
2017-09-15 ⋅ Fortinet ⋅ Xiaopeng Zhang
Deep Analysis of New Poison Ivy/PlugX Variant - Part II
Poison Ivy
2017-08-31 ⋅ NCC Group ⋅ Ahmed Zaki
Analysing a recent Poison Ivy sample
Poison Ivy
2017-08-23 ⋅ Fortinet ⋅ Xiaopeng Zhang
Deep Analysis of New Poison Ivy Variant
Poison Ivy
2017-08-02 ⋅ RSA Link ⋅ Ahmed Sonbol
Malspam delivers Xtreme RAT 8-1-2017
Xtreme RAT
2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK
PittyTiger
Enfal Ghost RAT MimiKatz Poison Ivy APT24
2017-03-14 ⋅ ClearSky ⋅ ClearSky Research Team
Operation Electric Powder – Who is targeting Israel Electric Company?
Molerat Loader
2016-11-22 ⋅ Palo Alto Networks Unit 42 ⋅ Jen Miller-Osborn, Robert Falcone, Tom Lancaster, Vicky Ray
Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy
Poison Ivy
2016-10-26 ⋅ Unknown ⋅ Chris Doman
Moonlight – Targeted attacks in the Middle East
Houdini NjRAT Molerats
2016-06-08 ⋅ ClearSky ⋅ ClearSky Research Team
Operation DustySky Part 2
Molerats
2016-04-26 ⋅ Github (CyberMonitor) ⋅ Jason Jones
New Poison Ivy Activity Targeting Myanmar, Asian Countries
Poison Ivy
2016-04-22 ⋅ Palo Alto Networks Unit 42 ⋅ Brandon Levene, Jen Miller-Osborn, Micah Yates, Mike Scott
New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists
Poison Ivy
2016-01-01 ⋅ ClearSky ⋅ ClearSky Research Team
Operation DustySky
Molerats
2015-12-08 ⋅ The Citizenlab ⋅ Claudio Guarnieri, John Scott-Railton, Marion Marschalek, Morgan Marquis-Boire
Packrat: Seven Years of a South American Threat Actor
AdWind Adzok CyberGate Xtreme RAT Packrat
2015-12-03 ⋅ Symantec ⋅ Symantec Security Response
Colombians major target of email campaigns delivering Xtreme RAT
Xtreme RAT
2015-09-28 ⋅ Kaspersky Labs ⋅ Ghareeb Saad, Mohamad Amin Hasbini
Gaza cybergang, where’s your IR team?
Molerats
2015-04-27 ⋅ PWC ⋅ Tom Lancaster
Attacks against Israeli & Palestinian interests
Molerats
2015-02-06 ⋅ CrowdStrike ⋅ CrowdStrike
CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
2014-09-19 ⋅ Palo Alto Networks Unit 42 ⋅ Jen Miller-Osborn, Ryan Olson
Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy
Poison Ivy
2014-06-02 ⋅ FireEye ⋅ Timothy Dahms
Molerats, Here for Spring!
Molerats
2014-02-19 ⋅ FireEye ⋅ James T. Bennett, Nart Villeneuve
XtremeRAT: Nuisance or Threat?
Xtreme RAT
2014-01-01 ⋅ FireEye ⋅ FireEye
Operation Quantum Entanglement
IsSpace NewCT Poison Ivy SysGet
2013-10-31 ⋅ FireEye ⋅ Ned Moran, Thoufique Haq
Know Your Enemy: Tracking A Rapidly Evolving APT Actor
Bozok Poison Ivy TEMPER PANDA
2013-08-23 ⋅ FireEye ⋅ Nart Villeneuve, Ned Moran, Thoufique Haq
Operation Molerats: Middle East Cyber Attacks Using Poison Ivy
Poison Ivy Molerats
2012-07-22 ⋅ Malware.lu ⋅ Malware.lu
Xtreme RAT analysis
Xtreme RAT
2012-01-13 ⋅ Middle East Online ⋅ Middle East Online
Cyber war: 'Gaza hackers' deface Israel fire service website
Molerats
2011-01-01 ⋅ Symantec ⋅ Erica Eng, Gavin O'Gorman
The Nitro Attacks: Stealing Secrets from the Chemical Industry
Poison Ivy Nitro
2010-01-01 ⋅ Mandiant ⋅ Ero Carrera, Peter Silberman
State of Malware: Family Ties
Bredolab Conficker Cutwail KoobFace Oderoor Poison Ivy Rustock Sinowal Szribi Zeus
Credits: MISP Project