WIRTE

WIRTE is a threat actor that has been identified as part of several overlapping groups, including TA402, Molerats, and Frankenstein. In mid-2023, Proofpoint researchers first noticed WIRTE's activity within TA402, which targeted Middle Eastern governments using an intricate infection chain and a new initial access downloader named IronWind. The group utilized documents deploying Visual Basic Script (VBS), often delivered via spear phishing, with Arabic content frequently associated with Palestinian matters. WIRTE's target selection and the nature of its distributed content further reinforce this connection. The group has also shown a continued reliance on tactics such as user agent filtering, payload building with HTML tags, redirection to news sites, and maintaining a consistent infrastructure style. The longstanding WIRTE Advanced Persistent Threat (APT) group's activities and tools have been revealed over the past year. In earlier campaigns, the group employed various tools like VBS and PowerShell scripts, while retaining signature techniques in the attacks discussed in this report. A unique encryption function introduced in newer versions of the malware has only been seen in WIRTE malware, suggesting minor changes and advancements in their methods. Based on historical ties and disruptive attack messaging, it is assessed that WIRTE likely has connections to Hamas. This association is supported by WIRTE's consistent targeting of the Palestinian Authority (PA) and historical links to groups associated with Hamas, such as Molerats and the Gaza Cyber Gang. However, these connections are assessed with low confidence, indicating that more evidence is needed to confirm these relationships definitively. Check Point Research identifies WIRTE as primarily deploying a tool called SameCoin, further cementing its status as a disruptive operation.