Molerats (G0021) | Threat Actor Index

About Molerats

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.

View MITRE record ↗

Techniques by Tactic (16)

Initial Access

T1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.015 CompressionT1140 Deobfuscate/Decode Files or InformationT1218.007 Msiexec

Defence Impairment

T1553.002 Code Signing

Credential Access

T1555.003 Credentials from Web Browsers

Discovery

T1057 Process Discovery

Command & Control

T1105 Ingress Tool Transfer

Toolsets (6)

🐛

DropBook S0547

Malware · Windows

🐛

DustySky S0062

Malware · Windows

🐛

MoleNet S0553

Malware · Windows

🐛

PoisonIvy S0012

Malware · Windows

🐛

SharpStage S0546

Malware · Windows

🐛

Spark S0543

Malware · Windows

References & Reports (5)