WIRTE Group

Also known as: G0090, White Dev 21

(LAB52) The DFIR (Digital Forensics and Incident Response) team of S2 Grupo first identified this actor in August 2018 and since then the follow-up has been carried out during the last few months. This group attacks the Middle East and does not use very sophisticated mechanisms, at least in the campaign started in August 2018 which was monitored. It is considered unsophisticated by the fact that the scripts are unobtrusive, communications go unencrypted by HTTP, they use Powershell (increasingly monitored), and so on. Despite this apparently unsophisticated modus operandi compared to other actors, they manage to infect their victims and carry out their objectives. In addition, as will be seen during the report, the detection rate of some of the scripts in December 2018 by the main antivirus manufacturers is low, an aspect that must be highlighted. We must be aware that once these scripts are executed, it is when the behavior analysis of many solutions will detect them, but this fact has not been studied by LAB52. This actor in all the artifacts analyzed shows his victims a decoy document in Arabic with different themes.

🌍 Country ["[Middle East]"]

Associated Operations

2024-02 Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/

Introduction

(LAB52) The DFIR (Digital Forensics and Incident Response) team of S2 Grupo first identified this actor in August 2018 and since then the follow-up has been carried out during the last few months. This group attacks the Middle East and does not use very sophisticated mechanisms, at least in the campaign started in August 2018 which was monitored. It is considered unsophisticated by the fact that the scripts are unobtrusive, communications go unencrypted by HTTP, they use Powershell (increasingly monitored), and so on. Despite this apparently unsophisticated modus operandi compared to other actors, they manage to infect their victims and carry out their objectives. In addition, as will be seen during the report, the detection rate of some of the scripts in December 2018 by the main antivirus manufacturers is low, an aspect that must be highlighted. We must be aware that once these scripts are executed, it is when the behavior analysis of many solutions will detect them, but this fact has not been studied by LAB52. This actor in all the artifacts analyzed shows his victims a decoy document in Arabic with different themes.

Activities and Tactics

Country of Origin: 🏳️ [“[Middle East]”]

Notable Campaigns

  • 2024-02
  • Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
  • https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • EmpireProject
  • H-Worm
  • Living off the Land
  • PowerShell and VBA scripts
  • SameCoin
  • several VBScript
  • EmpireProject:
  • H-Worm:
  • Living off the Land:
  • PowerShell and VBA scripts:
  • SameCoin:
  • several VBScript:

Attribution and Evidence

Country of Origin: [“[Middle East]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.