Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Molerats · Nation-state · assessed origin Palestine · misp-galaxy + mitre-attack · refreshed 2026-10-06

Molerats

  • Gaza Hackers Team
  • Gaza cybergang
  • Gaza Cybergang
  • Operation Molerats
  • Extreme Jackal
  • Moonlight
  • ALUMINUM SARATOGA
  • G0021

state sponsor · PalestineMITRE G0021 ↗

Molerats — ATT&CK roseMO

attack rose · 16 techniques across 8 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2023-38831

Analyst brief

misp-galaxy + mitre-attack

In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. S.

and UK governments. ”

Observed targets (as stated by the sources)

3 countries · 12 sectors
United StatesIsraelPalestineAssessed origin: Palestine

assessed origin · Palestineobserved targets · 3

countries · 3

  • United States
  • Israel
  • Palestine

sectors · 12

  • Government
  • Defense
  • Energy
  • Finance
  • Healthcare
  • Pharmaceuticals
  • Education
  • Media
  • NGOs
  • Civil Society
  • Legal
  • Military

also stated: Middle East, Europe

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

16 techniques · 8 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    6 techniques

  3. Persistence

    1 technique

  4. Stealth

    3 techniques

  5. Defense impairment

    1 technique

  6. Credential access

    1 technique

  7. Discovery

    1 technique

  8. Command and control

    1 technique

select a technique

Arsenal

6 malware
Malware
Malware · 6ATT&CK
MoleNetS0553 ↗
SparkS0543 ↗
DustySkyS0062 ↗
DropBookS0547 ↗
SharpStageS0546 ↗
PoisonIvyS0012 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Molerats is cited as exploiting

none on KEV
  1. CVE-2023-388312026-10-17
    1. “Starting in early September 2023, bLACKsTem exploited a reflected cross- site scripting (xss) vulnerability on the website of the Palestinian Civil Police Force (palpolice[.]ps). The link created a browser popup that redirected the visitor to a “news.rar” archive containing an exploit for a known bug (CVE-2023-38831) in the popular Windows file archiver tool WinRAR.”

      cited as exploiting · source: services.google.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Gaza Cybergang Unified Front Targeting Hamas OppositionSentinelone ↗
  2. 2022New espionage attack by Molerats APT targeting users in the Middle Eastzscaler ↗
  3. 2016Moonlight - Targeted attacks in the Middle EastVectra Networks ↗
  4. 2013Operation MoleratsFireEye ↗

Take it with you

keyless · no signup

References

20 sources
  1. 1.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle…
  2. 2.ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-mid…
  3. 3.ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-mid…
  4. 4.middle-east-online.com/en/cyber-war-gaza-hackers-deface-israel-fire-service-w…
  5. 5.fireeye.com/blog/threat-research/2014/06/molerats-here-for-spring.…
  6. 6.pwc.blogs.com/cyber_security_updates/2015/04/attacks-against-israeli…
  7. 7.vectra.ai/blogpost/moonlight-middle-east-targeted-attacks
  8. 8.securelist.com/gaza-cybergang-wheres-your-ir-team/72283
  9. 9.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WH…
  10. 10.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016…
  11. +10 more in the JSON record

Track Molerats on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.