Molerats

Molerats, also known as the Gaza Cybergang Group1, is a threat actor group historically associated with Hamas. The group has been tracked for over a decade under various names including Frankenstein and WIRTE, among others. Molerats, along with five other groups including APT 35 and Moses Staff, are linked to Iran, while two other groups have ties to China. The group primarily targets organizations in Saudi Arabia, the United Arab Emirates, and Israel, using advanced persistent threats (APTs) for their operations. The Molerats group has displayed significant adaptability and persistence, recently leveraging an improved downloader as part of its initial access operations. Furthermore, it is believed to be behind attacks on Israeli targets using a Rust-based version of SysJoker, a multi-platform backdoor first discovered by Intezer in 2021. This suggests a high level of sophistication and ability to exploit multiple platforms for malicious activities. Notably, new variants of SysJoker have revealed connections to Operation Electric Powder, a series of targeted attacks against Israeli organizations between 2016-2017, previously linked to Molerats. Despite the absence of activity from other Hamas-connected cyber threat actors like Extreme Jackal and Renegade Jackal after the Oct. 7 terrorist attack in Israel, Molerats continues to pose a significant threat. The group's long history, combined with its evolving tactics and techniques, underscores the need for continued vigilance and robust cybersecurity measures.