File · WIRTE · Unknown · assessed origin Palestine · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 26 techniques across 7 tactics
Analyst brief
misp-galaxy + mitre-attackWIRTE is a threat actor group that was first discovered in 2018. They are suspected to be part of the Gaza Cybergang, an Arabic politically motivated cyber criminal group. WIRTE has been observed changing their toolkit and operating methods to remain undetected for longer periods of time. They primarily target governmental and political entities, but have also been known to target law firms and financial institutions.
Kill chain
MITRE ATT&CK Enterprise · tap a technique26 techniques · 7 of 15 tactics
Resource development
4 techniquesInitial access
2 techniquesExecution
6 techniquesStealth
8 techniquesCollection
2 techniquesCommand and control
3 techniquesExfiltration
1 technique
select a technique
Arsenal
6 malware · 2 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
6 sources- 1.securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land…
- 2.lab52.io/blog/wirte-group-attacking-the-middle-east
- 3.unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ash…
- 4.attack.mitre.org/groups/G0090
- 5.research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disrupti…
- 6.securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land…
Track WIRTE on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.