Home/Threat Actor/Molerats / Gaza Cybergang
Threat Actor

Molerats / Gaza Cybergang

molerats_gaza_cybergang · palestinian_territories · active since 2011

Molerats / Gaza Cybergang Group 1 (TA402 / Extreme Jackal / DustySky / Aluminum Saratoga / BLACKSTEM / MITRE G0021) is a Palestinian-nexus cyber-espionage cluster operating publicly since at least October 2011 with intelligence- collection-supporting-Palestinian-political-objectives mission, a 13-year longitudinal operational history through approximately eight major industry public disclosures (FireEye 2013, ClearSky 2016, Kaspersky 2018-2019, Cybereason 2020, Palo Alto Unit 42 2020, Proofpoint 2022, Zscaler 2022, ongoing), in-house developed backdoor families (DustySky, Spark, Pierogi, DropBook, SharpStage, NimbleMamba, IronWind), Arabic-language malware configuration artifacts, politically-themed Israeli- Palestinian spear-phishing lures, naming-convention C2 command structures (cross-pollinated to two adjacent Gaza Cybergang sub-clusters), and signature abuse of legitimate public cloud services (Dropbox, Google Drive, Facebook accounts, Pastebin) as command-and-control dead-drop infrastructure.

consistently targets Middle Eastern and North African regional government, defense, intelligence, telecommunications, and diplomatic targets plus Palestinian- diaspora and Palestinian-political-faction personnel.

palestinian_territories confidence: high 24 aliases MITRE ATT&CK G0021 ↗

Profile

Molerats / Gaza Cybergang (also tracked as Gaza Hackers Team, Extreme Jackal, Moonlight, DustySky, TA402, Aluminum Saratoga, BLACKSTEM, Operation Molerats, and MITRE ATT&CK G0021) is a Palestinian-nexus cyber-espionage cluster active publicly since at least October 2011 and likely earlier, representing one of the longest-running continuously-tracked Middle Eastern regional cyber-espionage operations. Industry vendors (Kaspersky GReAT, Cybereason, Palo Alto Networks Unit 42, Proofpoint, Zscaler, FireEye/Mandiant, ClearSky, Check Point) assess the cluster with high confidence as Palestinian-aligned with intelligence-collection-supporting-Palestinian-political- and-security-objectives as the operational mission, with partial industry attribution specifically to Hamas-affiliated sponsorship and partial attribution more broadly to Palestinian- political-faction sponsorship without specific faction affiliation. No formal state-actor attribution has been asserted by any government cybersecurity authority, consistent with the absence of a fully-recognized Palestinian state actor.

the cluster is consequently most accurately framed as Palestinian-nexus or Palestinian-aligned rather than as formally state-sponsored. The cluster operates within a broader Gaza Cybergang umbrella that industry analysis (Kaspersky GReAT canonical disclosure 2018) has divided into three operationally-distinct sub- clusters: (a) Gaza Cybergang Group 1, the Molerats core, represented by this curated profile.

(b) Gaza Cybergang Group 2, also tracked as APT-C-23 or Arid Viper, distinct operator cluster with the Micropsia backdoor signature, separately curated profiling recommended.

(c) Gaza Cybergang Group 3, the cluster behind the 2017-2018 Operation Parliament campaign. The three sub-clusters share tradecraft patterns (Arabic-language malware configuration artifacts, naming- convention-based C2 command structures, politically-themed lure documents referencing Israeli-Palestinian developments, regional Middle Eastern victim targeting profiles, malware cross-pollination across sub-clusters) but are operationally distinct in tooling, infrastructure, and personnel. This YAML represents Group 1 / Molerats. The Arid Viper / APT-C-23 sub-cluster is referenced in aliases for umbrella searchability but is operationally distinct and recommended for separate curated profiling in a future curation pass. Operationally Molerats / Gaza Cybergang Group 1 has demonstrated multiple operationally-distinctive signature patterns across its 2011-2024 tracked history: (1) ARABIC-LANGUAGE MALWARE CONFIGURATION ARTIFACTS. Custom Molerats backdoors (DustySky, Spark, Pierogi, DropBook, SharpStage, NimbleMamba, IronWind) consistently include Arabic-language strings in malware-internal configuration data, debug strings, and C2 command-and-control naming conventions. The Arabic-language artifacts are the strongest consistent attribution signal across the cluster's longitudinal malware development. (2) POLITICALLY-THEMED SPEAR-PHISHING LURE DOCUMENTS. The cluster's primary initial-access vector is consistently spear-phishing email with weaponized Microsoft Office or RAR archive attachments carrying lure-content themed around Israeli-Palestinian political-affairs developments, Middle Eastern geopolitical events, diplomatic communications, and Palestinian-political-faction internal affairs. The lure- document content selection demonstrates clear operator intelligence-targeting-knowledge of victim-organization political-context interests. (3) ABUSE OF LEGITIMATE CLOUD SERVICES AS C2 INFRASTRUCTURE. One of the operationally-most-distinctive cluster tradecraft signatures is the abuse of legitimate public cloud services (Dropbox, Google Drive, Facebook accounts, YouTube comments, Pastebin) as command-and-control dead-drop and exfiltration infrastructure. Cybereason's December 2020 DropBook/SharpStage disclosure documenting the cluster's use of attacker- controlled Facebook account posts as C2 command-issue channel, and Zscaler's January 2022 disclosure of Google Drive and Dropbox abuse, are canonical industry references for this signature. The cloud-service-abuse-as-C2 pattern exploits legitimate-service-traffic profiles to evade traditional network-detection signatures focused on novel attacker- controlled infrastructure. (4) NAMING-CONVENTION-BASED C2 COMMAND STRUCTURES. Custom Molerats backdoors implement C2 command-and-control protocols that use proper-name keywords (people's names, common Arabic names) as command tokens rather than the typical numeric or letter-code command tokens of commodity RATs. The naming-convention C2 pattern is a tradecraft signature that cross-pollinates among the three Gaza Cybergang sub-clusters (Spark / Molerats Group 1, Micropsia / Arid Viper Group 2, Operation Parliament / Group 3 share this pattern), providing one of the strongest technical-cross-cluster-genealogical signals across the broader Gaza Cybergang umbrella. (5) LONGITUDINAL OPERATIONAL PERSISTENCE THROUGH PUBLIC DISCLOSURES. The cluster has demonstrated approximately 13 years of continuous public operation (2011-2024 and ongoing) despite repeated major industry disclosures by FireEye (2013), ClearSky (2016), Kaspersky (2018, 2019), Cybereason (2020), Palo Alto Unit 42 (2020), Proofpoint (2022), Zscaler (2022), and others. The cluster's response pattern is typically: brief operational pause following major disclosure; retooling of malware families (replacing exposed backdoor families with newly-developed variants)

resumption of broadly-similar targeting profiles with new tooling. The retooling-and-resumption cycle has been documented multiple times across the cluster's longitudinal history, demonstrating sustained in-house malware development capability rather than reliance on commodity-RAT-only tradecraft. (6) HISTORICAL HEAVY USE OF COMMODITY RATs (2011-2016 ERA). Through the cluster's early operational years (approximately 2011-2016), Molerats heavily used commodity remote-access trojans including njRAT, H-worm, Houdini, XtremeRAT, Poison Ivy, QuasarRAT, Bandook, and RevengeRAT, with custom- developed backdoor families becoming the operational primary tooling from approximately 2015-2016 onward (DustySky, Spark, Pierogi, DropBook, SharpStage, NimbleMamba, IronWind). The commodity-RAT-then-custom-backdoor operational progression mirrors the maturation pattern observed across multiple regional cyber-espionage clusters as operator-development capability matured over multi-year operational periods. Notable named operations include the canonical FireEye August 2013 Operation Molerats disclosure (Poison Ivy era)

the ClearSky January 2016 DustySky disclosure (custom-backdoor maturation era)

the Kaspersky GReAT April 2018 Operation Parliament disclosure (Gaza Cybergang Group 3 sub-cluster); the Kaspersky April 2019 SneakyPastes disclosure (Pastebin- based C2 dead-drop tradecraft)

the Cybereason January- February 2020 Spark and Pierogi backdoor disclosures (custom-backdoor-development era)

the Palo Alto Unit 42 January 2020 insurance-and-retail-expansion disclosure (target-profile diversification)

the Cybereason December 2020 DropBook + SharpStage + Facebook/Dropbox-C2 disclosure (cloud-service-abuse-as-C2 signature)

the Zscaler January 2022 Google Drive / Dropbox abuse campaign disclosure.

and the Proofpoint January 2022 TA402 / IronWind / NimbleMamba disclosure (post-2021-disclosure retooling). Targeting profile is consistently focused on Middle Eastern and North African (MENA) regional government, defense, intelligence, telecommunications, and diplomatic targets, with primary geographies including the Palestinian Territories, Israel, Egypt, Saudi Arabia, UAE, Iraq, Jordan, Lebanon, Syria, Turkey, Libya, Morocco, and Tunisia. Secondary targeting against Palestinian-diaspora populations, Palestinian-political-faction personnel, Palestinian-banking- sector personnel, journalists covering Palestinian affairs, and human-rights activists active on Palestinian-related issues is consistently observed. Less-frequent targeting against US, UK, and European diplomatic entities focused on Middle East policy has been observed. The cluster does not appear to maintain significant operational OPSEC discipline (Arabic-language malware artifacts are consistently visible, infrastructure reuse across campaigns is common, attribution-distinguishing tradecraft signatures are operationally stable across years). The cluster's response to public exposure is operational retooling rather than operational shutdown, demonstrating sustained operator- development capability and political-motivation-driven persistence rather than financially-motivated cost-benefit operational discipline. Analytically the Molerats / Gaza Cybergang Group 1 cluster is operationally significant as an example of a long-running regional non-state-actor cyber-espionage cluster operating with sustained intelligence-collection-targeting consistency, sustained in-house malware development capability, operationally-distinctive cloud-service-abuse-as-C2 tradecraft, and approximately 13 years of demonstrated operational continuity through repeated public disclosures. The cluster fills the only major Palestinian-aligned threat- actor cluster cell in modern cyber-threat-intelligence taxonomy and is canonically the longest-running publicly- tracked Palestinian-nexus cyber-espionage operation.

Aliases

24
g0021moleratsgaza cyberganggaza cyber ganggaza hackers teamgaza hacker teamextreme jackalmoonlightdustyskydusty skyoperation moleratsta402ta-402aluminum saratogaaluminum_saratogablackstemsparrowgaza_cyberganggaza_hackers_teamextreme_jackalgaza_cybergang_group_1apt-c-23arid viperdesert falcons

Notable Campaigns

11
2023-2024Operational-Tempo Increase Following October 2023 Israel-Hamas Conflict (2023-2024)
2022-2023IronWind Loader Campaigns Against Middle Eastern Diplomatic Entities (Proofpoint, 2022-2023)
2022Proofpoint TA402 Tracking, Espionage Returns with NimbleMamba (January 2022)
2021-2022Public Cloud Services Abuse Campaign, Google Drive and Dropbox (Zscaler ThreatLabz, January 2022)
2020DropBook + SharpStage + Facebook/Dropbox C2 Backdoors (Cybereason, December 2020)
2019-2020Spark and Pierogi Backdoor Campaigns (Cybereason, 2019-2020)
2019-2020Insurance and Retail Sector Targeting Expansion (Palo Alto Networks Unit 42, January 2020)
2019SneakyPastes Campaign (Kaspersky, April 2019)
2017-2018Operation Parliament, Gaza Cybergang Group 3 (Kaspersky, April 2018)
2015-2016DustySky Campaign and Cluster-Naming-Consolidation (2015-2016)
2013Operation Molerats, Initial Public Disclosure (FireEye, August 2013)

Attribution & Reporting

Attributed by
Kaspersky GReATCybereason NocturnusPalo Alto Networks Unit 42ProofpointZscaler ThreatLabzFireEyeMandiantClearSky Cyber SecurityCheck Point Research360 Threat Intelligence CenterTrend MicroTrellixCrowdStrikeMicrosoft Threat Intelligence CenterESETBitdefenderVolexityThreat ConnectIsraeli National Cyber Directorate (INCD, contextual)
Key reporting
reportFireEye: Operation Molerats, Middle East Cyber Attacks Using Poison Ivy (August 23, 2013), canonical first-disclosure publication
reportClearSky Cyber Security: Operation DustySky Report (January 2016 + January 2017 update), canonical 2015-2016-era reference
reportKaspersky GReAT: The Gaza Cybergang and Its SneakyPastes Campaign (April 10, 2019)
reportKaspersky GReAT: Gaza Cybergang, Where Are They Now (2018), Operation Parliament disclosure
reportCybereason Nocturnus: New Cyber Espionage Campaigns Targeting Palestinians, Spark + Pierogi (Parts 1+2) (January-February 2020)
reportCybereason Nocturnus: MoleRATs in the Cloud, New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign (DropBook + SharpStage, December 2020)
reportPalo Alto Networks Unit 42: Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations (January 22, 2020)
reportProofpoint: TA402 Uses Complex IronWind Loader in Latest Attacks Targeting Middle Eastern Government and Diplomatic Entities (January 4, 2022)
reportZscaler ThreatLabz: Molerats APT Launches New Espionage Campaign (January 2022)
reportCheck Point Research: Molerats Strikes Again, Decoy Pretext for Espionage (2020)
reportThreatConnect: Connections Between Arid Viper, Extreme Jackal, and Gaza Cybergang (multiple years)
report360 Threat Intelligence Center: Suspected Molerats New Attack in the Middle East (February 2019)
reportESET WeLiveSecurity: AridViper / Poison Ivy / Bandook Malware Extremely Resilient (February 2017), adjacent Gaza Cybergang Group 2 sub-cluster
reportESET: Operation in the Shadows (2019), Arid Viper sub-cluster operational analysis
reportBitdefender: APT-C-23 / Arid Viper Whitepaper, adjacent sub-cluster
reportTrend Micro / Trellix / Trustwave Continued Tracking of Gaza Cybergang Umbrella (multiple years)
reportMalpedia Actor Profile: Molerats
reportMITRE ATT&CK Group G0021, Molerats

Operational

State sponsor

Palestinian-nexus cyber-espionage cluster widely assessed by industry vendors (Kaspersky GReAT, Cybereason, Palo Alto Networks Unit 42, Proofpoint, Zscaler ThreatLabz, FireEye/ Mandiant, ClearSky, Check Point) as politically-aligned with Palestinian political-and-security interests. Public industry reporting variously attributes the cluster to Hamas-affiliated sponsorship, to broader Palestinian political-faction sponsorship (with Fatah-faction operations historically observed as a distinct sub-cluster), or to Palestinian- diaspora politically-motivated operators without specific faction affiliation. No formal state-actor attribution has been asserted by any government cybersecurity authority, consistent with the absence of a fully-recognized Palestinian state actor.

the cluster is consequently most accurately framed as Palestinian-nexus or Palestinian-aligned rather than as a formally state-sponsored APT. The cluster has been tracked across at least three operationally-distinct sub- clusters in industry reporting: (a) Gaza Cybergang Group 1 (the MoleRATs core, the cluster represented by this YAML); (b) Gaza Cybergang Group 2 (also tracked as APT-C-23 or Arid Viper, a distinct sub-cluster with a partially-overlapping tradecraft genealogy and the Micropsia backdoor signature); (c) Gaza Cybergang Group 3 (the cluster behind Operation Parliament, a 2017-2018 campaign with Middle Eastern governmental-organization targeting). The three Gaza Cybergang sub-clusters share tradecraft patterns (Arabic-language malware artifacts, naming-convention C2 command structures, politically-themed lure documents, Middle Eastern victim targeting) but are operationally distinct in tooling and personnel. This YAML represents the Molerats / Gaza Cybergang Group 1 cluster.

Arid Viper / APT-C-23 is operationally distinct and is recommended for separate curated profiling in a future curation pass.

Motivations
political_cyber_espionage, intelligence_collection_supporting_palestinian_political_objectives, intelligence_collection_against_regional_rivals, intelligence_collection_against_palestinian_diaspora_targets, influence_and_information_operations_via_credential_compromise
Sectors
Regions

Detection Blind Spots

60 techniques
Across this actor’s 60 mapped techniques, the share covered by each detection layer. Low bars are where you’d be blind if this actor targeted you.
Behavioral / log (Sigma)56/60 · 93%
Analytics (MITRE CAR)23/60 · 38%
Runtime / container (Falco)5/60 · 8%
File / malware (YARA)0/60 · 0%
Network (Suricata/Snort)12/60 · 20%
Vuln scan (Nuclei)0/60 · 0%

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder

Tools Used

4 mapped
Other tooling / TTPs (curation, not ATT&CK-mapped):
MOLERATSLOADER
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin