Molerats
Also known as Gaza Hackers Team, Gaza cybergang, Operation Molerats, Extreme Jackal, Moonlight, ALUMINUM SARATOGA, G0021, BLACKSTEM
In October 2012, malware attacks against Israeli government targets grabbed media attention as officials temporarily cut off Internet access for its entire police force and banned the use of USB memory sticks. Security researchers subsequently linked these attacks to a broader, yearlong campaign that targeted not just Israelis but Palestinians as well. and as discovered later, even the U.S. and UK governments. Further research revealed a connection between these attacks and members of the so-called “Gaza Hackers Team.” We refer to this campaign as “Molerats.”
Targets: Government, Defense, Energy, Finance, Healthcare, Pharmaceuticals, Education, Media, NGOs, Civil Society, Legal, Military, United States, Israel, Palestine
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
- Insects Don't Swarm at LED Lightshn · Nov 4, 2026
References
- https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html
- https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east/
- https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east-en/
- https://middle-east-online.com/en/cyber-war-gaza-hackers-deface-israel-fire-service-website
- https://www.fireeye.com/blog/threat-research/2014/06/molerats-here-for-spring.html
- https://pwc.blogs.com/cyber_security_updates/2015/04/attacks-against-israeli-palestinian-interests.html
- https://www.vectra.ai/blogpost/moonlight-middle-east-targeted-attacks
- https://securelist.com/gaza-cybergang-wheres-your-ir-team/72283/
- https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf
- https://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf
- https://securelist.com/gaza-cybergang-updated-2017-activity/82765/
- https://www.kaspersky.com/blog/gaza-cybergang/26363/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.