Molerats

Molerats, also known as Gaza Cybergang Group1, is a threat actor linked to Hamas that has been active for over a decade. This low-budget group has been tracked by researchers under various names including Molerats, Gaza Cybergang, Frankenstein, WIRTE, and Proofpoint’s TA402 designation. Among 16 Advanced Persistent Threat (APT) actors identified, Molerats was one of three groups connected to Hamas, with the others linked to Iran and China. The group's activities have predominantly targeted organizations in Saudi Arabia, the United Arab Emirates, and Israel. The Molerats group has been associated with several significant cyber-attacks, including the Electric Powder attacks and Operation Electric Powder, both of which targeted Israeli organizations. It is speculated that Molerats was behind these attacks due to their seasoned and effective hacking operations. Additionally, despite an absence of activity from other Hamas-connected cyber threat actors like Extreme Jackal and Renegade Jackal following the Oct. 7 terrorist attack in Israel, Molerats continued its operations unabated. Recently, Molerats has been implicated in attacks against Israeli targets using a Rust-based version of SysJoker, a multi-platform backdoor first discovered by Intezer in 2021. Researchers from Check Point revealed this in a blog post, further highlighting the group's persistent and evolving threat landscape. The group has also reportedly used an improved downloader as part of its initial access operations, demonstrating its ability to adapt and enhance its malicious capabilities.