WIRTE

MISP
Type:
Unknown
Country:
PS
First seen:
Unknown
Details:

[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)

MITRE ATT&CK: View on MITRE
Techniques Used (26)
ID ATT&CK Tactics
T1027.010 Command Obfuscation -
T1027.015 Compression -
T1036.005 Match Legitimate Resource Name or Location -
T1041 Exfiltration Over C2 Channel -
T1059.001 PowerShell -
T1059.003 Windows Command Shell -
T1059.005 Visual Basic -
T1071.001 Web Protocols -
T1074.001 Local Data Staging -
T1105 Ingress Tool Transfer -
T1106 Native API -
T1114.001 Local Email Collection -
T1140 Deobfuscate/Decode Files or Information -
T1204.001 Malicious Link -
T1204.002 Malicious File -
References (2)
Aliases (322)
Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus Ashen Lepus
Related Malware (8)
AshTag
other
Empire
tool
Ferocious
other
Havoc
other
IronWind
other
LitePower
other
Rclone
tool
SameCoin
other
Metadata
ID: 496
Created: 13/01/2026 17:48
Updated: 06/06/2026 16:00