FORENSIA

THREAT_ACTOR · G0021

Molerats

Also known as: Molerats, Operation Molerats, Gaza Cybergang

Profile

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.

MITRE ATT&CK ↗

Techniques

16 ATT&CK techniques attributed to this actor.

T1027.015 CompressionT1053.005 Scheduled TaskT1057 Process DiscoveryT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1105 Ingress Tool TransferT1140 Deobfuscate/Decode Files or InformationT1204.001 Malicious LinkT1204.002 Malicious FileT1218.007 MsiexecT1547.001 Registry Run Keys / Startup FolderT1553.002 Code SigningT1555.003 Credentials from Web BrowsersT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Software

6 malware/tools attributed to this actor.

PoisonIvyDustySkySparkSharpStageDropBookMoleNet

Related corpus activity

9,847 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Molerats.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2014-2321cve—851
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2022-47945cve—851
cve-2016-15047cve—854
cve-2025-23304cve—852
cve-2024-1781cve—851
cve-2023-44976cveransomware852
cve-2016-5681cve—852
cve-2020-17456cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,847.