- Category
- State · Attributed to a state or working for one.
- Origin
- Palestine(medium confidence)
- Sponsor
- Hamas
- Motivation
- Information theft and espionage; Sabotage and destruction
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0090 · 26 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0106 · wirte
PalestineWhat it is
WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0090
- PwC
- White Dev 21
- Other names
- WIRTE Group, Ashen Lepus, Group WITRE
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
- MISP Galaxy (CFR tagging)Palestine
Targets
- Countries
- Egypt, Iraq, Israel, Jordan, Lebanon, Saudi Arabia
- Sectors
- Defense, Government
Tools
The tools and malware families the sources tie to it.
- Arabian-Attacker RAT
- AshTag
- Cyber Eye RAT
- CyberGate
- Empire
- EmpireProject
- Ferocious
- H-Worm
- Havoc
- IronWind
- LitePower
- Living off the Land
- PowerShell and VBA scripts
- Rclone
- SameCoin
- several VBScript
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de