Molerats
IntrusionSet · ATTACK:enterprise:G0021
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0021",
"title": "Molerats",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0021",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--df71bb3b-813c-45eb-a8bc-f2a419837411",
"external_id": "G0021",
"domain": "enterprise",
"created": "2017-05-31T21:31:55.093Z",
"modified": "2026-07-31T18:48:22.843Z",
"version": "2.1",
"aliases": [
"Molerats",
"Operation Molerats",
"Gaza Cybergang"
],
"tactics": [
],
"source_references": [
{
"source_name": "Molerats"
},
{
"source_name": "Gaza Cybergang"
},
{
"source_name": "Operation Molerats"
},
{
"source_name": "DustySky2",
"url": "http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf"
},
{
"source_name": "DustySky",
"url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
},
{
"source_name": "Cybereason Molerats Dec 2020",
"url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
},
{
"source_name": "Kaspersky MoleRATs April 2019",
"url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
},
{
"source_name": "FireEye Operation Molerats",
"url": "https://web.archive.org/web/20201031075438/https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--049d2b7e-fb1e-4bf3-bf2f-97197e40bda2
Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0da9ee24-37ac-4568-b1fc-d784f05dfc97
Unit42 Molerat Mar 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dd7e88b-aeea-4b14-a06c-becaa94f8bba
Unit42 Molerat Mar 2020 · Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21ebcd72-cb89-4d26-82b7-4d17843034c5
Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fd0b80f-d053-4679-a350-1bb45b32ab49
Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--361cbd71-b178-44d0-9802-78a310938bad
FireEye Operation MoleratsATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--383a50af-eeeb-40e5-b4df-8a1a9c5baa69
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0062
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cdc74fc-a291-4253-98b4-ca33e021914a
DustySky · DustySky2 · Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f898155-f810-4d2c-8e30-34723d845ade
Unit42 Molerat Mar 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0547
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41b74267-f604-4581-b1ca-4f1907a82245
Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--497aec05-cb34-424d-943f-4fdfbf2585b4
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a9f2571-e611-4f7f-b0c9-6fc2d306b2f6
Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020 · Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e757efa-8231-4674-a1ea-e234e2dfb838
DustySkyATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fd1b042-8543-46f7-90d5-631500f17e9e
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0546
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f321c37-1463-4b55-a3d5-f2e517ede0b7
Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a06bd922-b887-4134-81cb-1e4180cf5a5a
DustySkyATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa4038e3-451f-4ad7-acc7-5c971825967b
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2562bd3-5f78-4bcb-a37b-cae2b415c629
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5ba1f46-0dd0-49f7-9d24-3822153229ba
Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbba2f85-d5f4-4306-a219-5eea6c59dbb6
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e586e3c7-ed6b-4f6b-92e8-031f0acc84ef
Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020 · Cybereason Molerats Dec 2020ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fad44d26-02a8-4cdc-b566-5e24f32a93b3
DustySky2 · DustySky · FireEye Operation Molerats