MoleratsThreat actor
- aluminum saratoga
- blackstem
- extreme jackal
- g0021
- gaza cybergang
- gaza hackers team
- Moonlight
- operation molerats
In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. and as discovered later, even the U. S.From MISP Galaxy
Last reported 2 years ago, by Group-IB1 report
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1033System Owner/User Discovery
“T1033: System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“T1041: Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“We presume that the additional payload or new updates to the code will involve installing AnyDesk, and creating a scheduled task for it.”
- T1056Input Capture
“T1056.001: Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001: Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.006: Command and Scripting Interpreter: Python”
What the reports say
1 report, newest first · the exact sentence from each-
APT Lazarus: Eager Crypto Beavers, Video calls and Games“In addition to Linkedin, Lazarus is also actively searching for potential victims on other job search platforms such as WWR, Moonlight, Upwork, and others.”
Indicators in its reports
named in the reports above- hxxp://www.apple[.]com/DTDs/PropertyList-1.0.dtdin 1 report
- ad.anynet[.]idin 1 report
- 1bbb953890e752a6…2dda0bd89e14in 1 report
- 675928d7a0a28f70740b7eedf021de82in 1 report
- 2c5e45a85a8eed94ffed26a7c3b0790ein 1 report
- hxxp://23.106.253[.]194:1244in 1 report
- 23.106.253[.]194in 1 report
- hxxp://45.140.147[.]208:54321in 1 report
- 45.140.147[.]208in 1 report
- hxxp://95.164.17[.]24:1224in 1 report
- 95.164.17[.]24in 1 report
- hxxp://185.235.241[.]208:1224in 1 report
- 185.235.241[.]208in 1 report
- hxxp://freeconference[.]ioin 1 report
- freeconference[.]ioin 1 report
- hxxp://mirotalk[.]netin 1 report
- mirotalk[.]netin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.