FlagThis

← All Threat Actors
Threat Actor Profile

WIRTE

Ashen Lepus G0090
▲ High Threat
WIRTE is a threat actor group that was first discovered in 2018. They are suspected to be part of the Gaza Cybergang, an Arabic politically motivated cyber criminal group. WIRTE has been observed changing their toolkit and operating methods to remain undetected for longer periods of time. They primarily target governmental and political entities, but have also been known to target law firms and financial institutions.
Origin Palestine

Known TTPs

PowerShell
Non-Standard Port
Visual Basic
Local Email Collection
Malicious File
Upload Malware
Deobfuscate/Decode Files or Information
Spearphishing Attachment
Windows Command Shell
Malicious Link
Match Legitimate Resource Name or Location
Local Data Staging
Tool
Email Accounts
Exfiltration Over C2 Channel
Domains
Web Protocols
DLL
System Checks
Spearphishing Link
Impersonation
Native API
Regsvr32
Ingress Tool Transfer
Compression
Command Obfuscation

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD