Molerats

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

State sponsor: PalestineTarget categories: Government, Defense, Energy, Finance, Healthcare, Pharmaceuticals, Education, Media, NGOs, Civil Society, Legal, Military

Targeted regions: United States · Israel · Palestine · Middle East · Europe

Also known as:ALUMINUM SARATOGABLACKSTEMExtreme JackalG0021Gaza CybergangGaza Hackers TeamGaza cybergangMoonlightOperation Molerats

Vexday analysis

Molerats (também referenciado como Operation Molerats e Gaza Cybergang, identificador MITRE ATT&CK G0021) é um grupo APT de língua árabe com motivação política em atividade desde 2012. Suas vítimas estão concentradas principalmente no Oriente Médio, na Europa e nos Estados Unidos. O grupo possui 16 técnicas documentadas na base MITRE ATT&CK.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity30

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Visual Basic JavaScript Malicious Link Malicious File

Persistence

Registry Run Keys / Startup Folder

Credential access

Credentials from Web Browsers

Discovery

Process Discovery

Command and control

Ingress Tool Transfer

defense-impairment

Code Signing

stealth

Compression Deobfuscate/Decode Files or Information Msiexec

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

Molerats uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →