Gaza Cybergang

Gaza Cybergang, a threat actor group affiliated with Hamas, has been active since at least 2012, targeting entities in the Middle East and North Africa. The group's activities primarily involve intelligence collection and espionage campaigns against Palestinian and Israeli victims. Researchers have identified several subgroups under the Gaza Cybergang umbrella, including Gaza Cybergang Group 1 (Molerats), Group 2 (Arid Viper, Desert Falcons, APT-C-23), and Group 3 (the group behind Operation Parliament). These groups have shown consistent activity over the years, using sophisticated malware such as Pierogi++ to enhance their capabilities and evade detection. WIRTE is believed to be another subgroup connected to Gaza Cybergang, although this association is assessed with low confidence. Despite the ongoing war in the region, WIRTE's activities continue, indicating a persistent threat landscape. Check Point Research found links between recent attacks using the Rust-based SysJoker and the 2016-2017 Electric Powder Operation against Israel Electric Company, previously attributed to Gaza Cybergang. This connection suggests that the same actors may be involved, despite the significant time gap between the operations. The Gaza Cybergang's modus operandi involves the use of phishing attacks and social media engagements to circulate malicious files. At the start of the year, there were several detected cases where the group adjusted its Tactics, Techniques, and Procedures (TTPs) slightly. However, no increase in the baseline volume of activity has been observed since the start of the Gaza conflict in October. Furthermore, the group has demonstrated an ability to maintain and innovate its malware arsenal, as evidenced by the new variation of the Pierogi++ backdoor malware used in recent attacks.