Molerats TARGETS Palestinian Authority
Assaf says the group targeted political figures within the Palestinian Authority.
Explicit Confidence 98% · Assaf Dahan EP 89 Details
“they targeted political figures within the Palestinian authority”
Threat actor
threat_actor:molerats
Also: Gaza Cyber Gang
Arabic-speaking, politically motivated activity group operating in the Middle East and North Africa and targeting government, political, activist, and diplomatic entities.
Arabic-speaking, politically motivated activity group operating in the Middle East and North Africa and targeting government, political, activist, and diplomatic entities.
“there were some clues that led Cybereason to believe they were dealing with a threat actor called a Molerat”
“Molerats is quite a well-defined activity group”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | Palestinian Authority | Explicit | 89 |
| outgoing | TARGETS | Fatah | Explicit | 89 |
| outgoing | TARGETS | Fatah | Attributed | 89 |
| outgoing | TARGETS | Palestine | Explicit | 89 |
| outgoing | USES | phishing | Derived | 89 |
| outgoing | SAME_AS | Gaza Cyber Gang | Attributed | 89 |
| outgoing | ASSOCIATED_WITH | Hamas | Uncertain | 89 |
| incoming | ATTRIBUTED_TO | Spark | Uncertain | 89 |
Molerats TARGETS Palestinian Authority
Assaf says the group targeted political figures within the Palestinian Authority.
Explicit Confidence 98% · Assaf Dahan EP 89 Details
“they targeted political figures within the Palestinian authority”
Assaf says the targeted Palestinian Authority figures were associated with Fatah, and that the group targets political figures and entities in the region.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“political figures within the Palestinian authority that associated with Fatah”
The episode describes Molerats as mostly targeting people in Palestine and Israel, including political figures.
Explicit Confidence 96% · Jack Rhysider EP 89 Details
“They have mostly targeted people in Palestine and Israel”
Molerats' campaigns are described as sending targeted phishing emails and documents to victims.
Derived Confidence 97% · Assaf Dahan EP 89 Details
“the operators sent a phishing PDF to their victims.”
“specific individuals were sent these phishing e-mails”
Assaf assesses with moderate to high confidence that Molerats was likely behind the campaign in which Spark was discovered; attribution is hedged.
Uncertain Confidence 82% · Assaf Dahan EP 89 Details
“you can say that with, I don’t know, moderate to high confidence that it’s likely Molerats who is behind it.”
Molerats SAME_AS Gaza Cyber Gang
Jack reports that FireEye calls the group Molerats while Kaspersky calls the same group the Gaza Cyber Gang.
Attributed Confidence 93% · Jack Rhysider EP 89 Details
“FireEye calls this group Molerats but Kaspersky calls this same group the Gaza Cyber Gang.”
Molerats ASSOCIATED_WITH Hamas
Jack's research leads him to conclude that Molerats is somehow allied with Hamas, but he explicitly says the connection is uncertain.
Uncertain Confidence 72% · Jack Rhysider EP 89 Details
“my conclusion is that Molerats is somehow allied with Hamas.”
“I’m not sure to what degree Molerats might be connected with Hamas, if at all.”
Jack says reports show Molerats targeting Fatah but not members of Hamas.
Attributed Confidence 91% · Jack Rhysider EP 89 Details
“they do target Fatah.”