Molerats - G0021

Created: 2017-05-31T21:31:55.093Z

Modified: 2021-04-27T20:16:16.057Z

Contributors:

Aliases

Molerats,Operation Molerats,Gaza Cybergang

Description

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)

Techniques Used

Molerats has used msiexec.exe to execute an MSI payload.(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Molerats has created scheduled tasks to persistently run VBScripts.(Citation: Unit42 Molerat Mar 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Molerats decompresses ZIP files once on the victim machine.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Molerats used PowerShell implants on target machines.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Molerats used various implants, including those built with JS, on target machines.(Citation: Kaspersky MoleRATs April 2019)   |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|