ATK89

ATK89 (aka: Molerats, Gaza Cybergang) is an Arabic politically motivated APT group, active all over the world, including in Europe and the US, but they are mainly active in the Middle East and North Africa (MENA) and in Palestine in particular. The group is comprised of three sub-groups:

• Gaza Cybergang Group 1: aka MoleRATs: The group’s aim is to the infection of the victim in a RAT and it often makes use of text-sharing platforms, such as: PasteBin, github.com, upload.cat and more.

• Gaza Cybergang Group 2: aka Desert Falcons: the group makes use of homemade malware, tools and techniques. Victims are often infected by social engineering methods such as fake websites that promise political information or spear phishing emails and social messaging.

• Gaza Cybergang Group 3: aka Operation Parliament: The group is focused on espionage, covering on executive and judicial bodies all over the world, and focusing on MENA, particularly Palestine. the group used malware with CMD/PowerShell commands for its attacks. Each group is different in TTPs, but they make use of the same tools after gaining the initial grip on their victims.
•  

ATK89 is a persistent threat to organizations and governments in the Middle East, routinely updating not only their malware implants, but also their delivery methods.