🇵🇸

WIRTE Group

APT Group Information theft and espionage Sabotage and destruction ETDA ✓

Also Known As 4 names

White Dev 21 G0090 WIRTE Ashen Lepus

Target Countries 13

Countries highlighted in red

Armenia Cyprus Egypt Israel Iraq Jordan Lebanon Morocco Oman Palestine Saudi Arabia Syrian Arab Republic Turkey

Sectors Targeted

National Security and International Affairs 928 Government Information 51 Health Care and Social Assistance 62 Public Administration 92 Defense Finance and Insurance 52 Offices of Lawyers 541110 diplomats

Details

Origin 🇵🇸 PS

Last Updated 11 May 2024

Malware Families 1

ashas

MITRE ATT&CK 44

T1027 T1027.010 T1027.015 T1036 T1036.005 T1041 T1047 T1059 T1059.001 T1059.003 T1059.005 T1071 T1071.001 T1074 T1074.001 T1105 T1106 T1114 T1114.001 T1140 T1193 T1204 T1204.001 T1204.002 T1218 T1218.010 T1497 T1497.001 T1566 T1566.001 T1566.002 T1571 T1574 T1574.001 T1583 T1583.001 T1586 T1586.002 T1588 T1588.002 T1608 T1608.001 T1684 T1684.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

WIRTE Group LAB52

White Dev 21 PWC

G0090 MITRE

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

Egypt Iraq Israel Jordan Lebanon Saudi Arabia Palestinian Authority

Description

(LAB52) The DFIR (Digital Forensics and Incident Response) team of S2 Grupo first identified this actor in August 2018 and since then the follow-up has been carried out during the last few months. This group attacks the Middle East and does not use very sophisticated mechanisms, at least in the campaign started in August 2018 which was monitored. It is considered unsophisticated by the fact that the scripts are unobtrusive, communications go unencrypted by HTTP, they use Powershell (increasingly monitored), and so on. Despite this apparently unsophisticated modus operandi compared to other actors, they manage to infect their victims and carry out their objectives. In addition, as will be seen during the report, the detection rate of some of the scripts in December 2018 by the main antivirus manufacturers is low, an aspect that must be highlighted. We must be aware that once these scripts are executed, it is when the behavior analysis of many solutions will detect them, but this fact has not been studied by LAB52. This actor in all the artifacts analyzed shows his victims a decoy document in Arabic with different themes.

Tools Used 5

EmpireProject H-Worm SameCoin Living off the Land several VBScript, PowerShell and VBA scripts

Operations 1

2024-02 Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/

Reports & References 3

https://lab52.io/blog/wirte-group-attacking-the-middle-east/ https://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/

ETDA Profile

WIRTE Group

Origin

[Middle East]

First Seen 2018

Sponsor Hamas

Motivation

Information theft and espionage Sabotage and destruction

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0090/

View on ETDA APT Groups ↗