Gaza Cybergang

The Gaza Cybergang is a threat actor that has been active since at least 2012, primarily targeting the Middle East and North Africa. The group is known for its intelligence collection and espionage campaigns against Palestinian and Israeli victims. It consists of three main subgroups: Group 1 (Molerats), Group 2 (Arid Viper, Desert Falcons, APT-C-23), and Group 3 (the group behind Operation Parliament). The gang uses a diverse set of tools, including interpreted language malware such as VBS and PowerShell scripts, which adds flexibility to update their toolset and avoid static detection controls. In addition, they have recently shown a commitment to enhancing their capabilities and evading detection by innovating their malware, as evidenced by the development of Pierogi++. Over the years, Gaza Cybergang's activities have created some confusion within the cybersecurity community due to the separation of roles and campaigns. There are suspicions, albeit with low confidence, that the WIRTE group is related to or even a subgroup under the Gaza Cybergang umbrella. At the start of this year, several cases involving Gaza Cybergang were detected in which the threat actor slightly adjusted its Tactics, Techniques, and Procedures (TTPs). Despite these adjustments, there have been no observed significant changes in dynamics since the start of the Israel-Hamas war. In recent developments, an Advanced Persistent Threat (APT) group believed to be Gaza Cybergang (aka Molerats) has attacked Israeli targets using a Rust-based version of SysJoker, a multi-platform backdoor first discovered in 2021. Links have also been found between these latest attacks and the 2016-2017 Electric Powder Operation against the Israel Electric Company, attributed to Gaza Cybergang. This connection, despite the significant time gap between the operations, suggests a continued threat from the group. However, it's worth noting that the group hasn't increased its baseline volume of activity since the start of the Gaza conflict in October.