FORENSIA

THREAT_ACTOR · G0090

WIRTE

Also known as: WIRTE, Ashen Lepus

Profile

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.

MITRE ATT&CK ↗

Techniques

26 ATT&CK techniques attributed to this actor.

T1027.010 Command ObfuscationT1027.015 CompressionT1036.005 Match Legitimate Resource Name or LocationT1041 Exfiltration Over C2 ChannelT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1071.001 Web ProtocolsT1074.001 Local Data StagingT1105 Ingress Tool TransferT1106 Native APIT1114.001 Local Email CollectionT1140 Deobfuscate/Decode Files or InformationT1204.001 Malicious LinkT1204.002 Malicious FileT1218.010 Regsvr32T1497.001 System ChecksT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1571 Non-Standard PortT1574.001 DLLT1583.001 DomainsT1586.002 Email AccountsT1588.002 ToolT1608.001 Upload MalwareT1684.001 Impersonation

Software

8 malware/tools attributed to this actor.

EmpireFerociousLitePowerRcloneHavocIronWindSameCoinAshTag

Related corpus activity

10,260 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to WIRTE.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2013-3307cve—852
cve-2014-2321cve—851
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2025-66478cve—852
cve-2021-27076cve—851
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2016-5681cve—852
cve-2022-47945cve—851
cve-2025-0921cve—852
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2023-44976cveransomware852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,260.