MITRE ATT&CKgroup
G0090 WIRTE
- Domain
- enterprise, mobile
- Aliases
- Ashen Lepus
- Version
- 3.0
- Created
- 2019-05-24
Description
WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.
Related
Uses · MITRE ATT&CK (34)
- S9029 IronWind software (malware)
- S9030 SameCoin software (malware)
- S9031 AshTag software (malware)
- T1684.001 Impersonation sub-technique
- S1229 Havoc software (malware)
- T1027.015 Compression sub-technique
- T1027.010 Command Obfuscation sub-technique
- S1040 Rclone software (tool)
- S0680 LitePower software (malware)
- S0679 Ferocious software (malware)
- T1608.001 Upload Malware sub-technique
- T1586.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1571 Non-Standard Port technique
- T1074.001 Local Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1114.001 Local Email Collection sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1218.010 Regsvr32 sub-technique
- S0363 Empire software (tool)
References
- https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/ Check Point Wirte NOV 2024
- https://lab52.io/blog/wirte-group-attacking-the-middle-east/ Lab52 WIRTE Apr 2019
- https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/ Palo Alto Ashen Lepus DEC 2025
- https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044 Kaspersky WIRTE November 2021