WIRTE

Techniques (MITRE ATT&CK)26

SourceMITRE ATT&CK

Also known as:Ashen Lepus

Vexday analysis

Ator de ciberespionagem associado ao Gaza Cybergang — grupo afiliado ao Hamas —, o WIRTE (também conhecido como Ashen Lepus, identificador MITRE G0090) está ativo desde pelo menos agosto de 2018. O grupo tem como alvos organizações diplomáticas, financeiras, militares, jurídicas e de tecnologia no Oriente Médio, no Norte da África e na Europa, com objetivo de coleta de inteligência. Apesar do conflito em curso entre Israel e Hamas, o grupo manteve atividade persistente e expandiu suas operações para incluir ataques com malware destrutivo do tipo wiper contra alvos israelenses. Ao todo, 26 técnicas do framework MITRE ATT&CK foram documentadas para este agente.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity31

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 26

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Email Accounts Tool Upload Malware

Initial access

Spearphishing Attachment Spearphishing Link

Execution

PowerShell Windows Command Shell Visual Basic Native API Malicious Link Malicious File

Collection

Local Data Staging Local Email Collection

Command and control

Web Protocols Ingress Tool Transfer Non-Standard Port

Exfiltration

Exfiltration Over C2 Channel

stealth

Command Obfuscation Compression Match Legitimate Resource Name or Location Deobfuscate/Decode Files or Information Regsvr32 System Checks DLL Impersonation

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

WIRTE uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →