Molerats

APT / StateG0021 ↗
Techniques (MITRE ATT&CK)16
SourceMITRE ATT&CK
State sponsor: PalestineTarget categories: Government, Defense, Energy, Finance, Healthcare, Pharmaceuticals, Education, Media, NGOs, Civil Society, Legal, Military
Targeted regions: United States · Israel · Palestine · Middle East · Europe
Also known as:ALUMINUM SARATOGABLACKSTEMExtreme JackalG0021Gaza CybergangGaza Hackers TeamGaza cybergangMoonlightOperation Molerats

About the group

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity30
Impact: High
T1566.001T1053.005T1547.001T1555.003ENTRYInitial accessSpearphishingAttachmentEXECExecutionScheduled TaskPERSPersistenceRegistry Run Keys/ Startup FolderCREDCredential accessCredentials fromWeb BrowsersDISCDiscoveryProcess Discovery

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Molerats uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →