Home / Threat actors / WIRTE

WIRTE G0090

🔔 Create alert

Also known as: Ashen Lepus

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

28

Techniques

8

Malware and tools

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.001 Domains T1586.002 Email Accounts T1588.002 Tool T1608.001 Upload Malware

Initial Access

T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL

Stealth

T1027.010 Command Obfuscation T1027.015 Compression T1036.005 Match Legitimate Resource Name or Location T1140 Deobfuscate/Decode Files or Information T1218.010 Regsvr32 T1497.001 System Checks T1574.001 DLL T1684.001 Impersonation

Discovery

T1497.001 System Checks

Collection

T1074.001 Local Data Staging T1114.001 Local Email Collection

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer T1571 Non-Standard Port

Exfiltration

T1041 Exfiltration Over C2 Channel

Malware and tools

AshTagMalwareS9031
FerociousMalwareS0679
HavocMalwareS1229
IronWindMalwareS9029
LitePowerMalwareS0680
SameCoinMalwareS9030
EmpireToolS0363
RcloneToolS1040

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.