WIRTE
- ID
- G0090
- Associated names
- Ashen Lepus
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]
Techniques used (26)
- T1027.010 Command Obfuscation
- T1027.015 Compression
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1114.001 Local Email Collection
- T1140 Deobfuscate/Decode Files or Information
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.010 Regsvr32
- T1497.001 System Checks
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1571 Non-Standard Port
- T1574.001 DLL
- T1583.001 Domains
- T1586.002 Email Accounts
- T1588.002 Tool
- T1608.001 Upload Malware
- T1684.001 Impersonation
Software used (8)
- S0363 Empire
- S0679 Ferocious
- S0680 LitePower
- S1040 Rclone
- S1229 Havoc
- S9029 IronWind
- S9030 SameCoin
- S9031 AshTag