Molerats

Threat Actors · Molerats

· ATT&CK GroupG0021

Operation MoleratsGaza Cybergang

Techniques

Software

Tactics

Aliases

Description

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)

Tactic Coverage

execution (6)stealth (3)persistence (2)privilege escalation (2)initial access (2)discovery (1)command and control (1)defense impairment (1)credential access (1)

Techniques Used (16)

T1027.015Compression

stealth

T1053.005Scheduled Task

executionpersistence

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.005Visual Basic

execution

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 16 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (6)

S0547DropBookmalware S0062DustySkymalware S0553MoleNetmalware S0012PoisonIvymalware S0546SharpStagemalware S0543Sparkmalware

References (9)

https://attack.mitre.org/groups/G0021 http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/https://web.archive.org/web/20201031075438/https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html