- Category
- State · Attributed to a state or working for one.
- Origin
- Palestine(high confidence)
- Sponsor
- Hamas
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0021 · 16 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0138 · molerats
PalestineWhat it is
Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Extreme Jackal
- MITRE ATT&CK
- G0021
- Proofpoint
- TA402
- Operations
- Operation Molerats, Operation “DustySky”, Operation “DustySky” Part 2, Operation “Molerats”, Operation “Moonlight”, Operation “SneakyPastes”, Operation “TopHat”
- Other names
- Aluminum Saratoga, ATK 89, BLACKSTEM, Gaza cyber gang, Gaza Cybergang, Gaza Hacker Team, Gaza Hackers Team, Molerats, Extreme Jackal, Gaza Cybergang, Moonlight, TAG-CT5
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
- MISP Galaxy (CFR tagging)Palestine
- ThreatActor.info (Malpedia et al.)Palestine · high
Targets
- Countries
- Afghanistan, Algeria, Canada, Chile, China, Denmark, Egypt, Europe, Germany, India, Iran, Iraq, Israel, Jordan, Kuwait, Latvia, Lebanon, Libya, Macedonia, Middle East, Morocco, New Zealand, Oman, Palestine, Qatar, Russia, Saudi Arabia, Serbia, Slovenia, Somalia, South Korea, Syria, Türkiye, United Arab Emirates, United Kingdom, United States, Yemen
- Sectors
- Aerospace, Civil Society, Defense, Education, Embassies, Energy, Finance, Financial, Government, Healthcare, High-Tech, Legal, Media, Military, NGOs, Oil and gas, Pharmaceuticals, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- CloudDuke
- Don’t Kill My Cat (DKMC)
- DropBook
- DustySky
- MoleNet
- NeD Worm
- Poison Ivy
- PoisonIvy
- RTFs Exploiting CVE-2017-0199
- Scote
- SharpStage
- Spark
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de