Molerats
Molerats is classified as hacktivist.
- Malware families
- 11
- Suspected state sponsor
- Palestinian Territories
- Also known as
- 9
In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. and as discovered later, even the U.S. and UK governments. Further research revealed a connection between these attacks and members of the so-called “Gaza Hackers Team.” We refer to this campaign as “Molerats.”
The group is suspected of operating with the support of Palestinian Territories.
The group is associated with 11 malware families.
Also known as: Gaza Hackers Team, Gaza cybergang, Gaza Cybergang, Operation Molerats, Extreme Jackal, Moonlight, ALUMINUM SARATOGA, G0021, BLACKSTEM
The group is associated with 11 malware families.
Malware families
- BadPatch
- BrittleBush
- DropBook
- MoleNet
- Molerat Loader
- NimbleMamba
- Pierogi
- Poison Ivy
- SharpStage
- Spark
- Xtreme RAT
Published reports on this actor:
- https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html
- https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east/
- https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east-en/
Source: MISP Galaxy, Malpedia.
What does a hacktivist do?
Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.
Which defenses matter most?
- Use denial-of-service protection and a content delivery network for your website and APIs.
- Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
- Monitor announcement channels: target lists are shared before attacks.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.