Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| MoleratsOperation Molerats, Gaza Cybergang, Gaza Hackers Team, Extreme Jackal | Palestine | Espionage | – | – | 16 | 6 | ATT&CK G0021 · MISP Galaxy |
| Ashen LepusWIRTE | Palestine | – | – | – | 26 | 8 | CyberSIXT · ATT&CK G0090 · MISP Galaxy |
| APT-C-23Mantis, Arid Viper, Desert Falcon, TAG-63 | Palestine | Espionage | – | – | 3 | 5 | ATT&CK G1028 · MISP Galaxy |
| BlackatomRecent campaigns suggest Hamas-linked actors may be advancing their TTPs to include intricate social engineering lures specially crafted to appeal to a niche group of high value targets. In September 2023, a Palestine-ba | Palestine | Espionage | – | – | – | – | MISP Galaxy |
| BiBiGunA pro-Hamas hacktivist group developed a wiper called BiBi-Linux to target and destroy data on Israeli systems. The malware impersonates ransomware but operates solely to corrupt and delete files, indicating no data thef | Palestine | – | – | – | – | – | MISP Galaxy |
| BlackmetaSN Blackmeta | Palestine | – | – | – | – | – | MISP Galaxy |
| HandalaHandala Hack | Palestine | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Storm-1133In early 2023, Microsoft In early 2023, observed a wave of activity from a Gaza-based group that we track as Storm-1133 targeting Israeli private sector energy, defense, and telecommunications organizations. | Palestine | – | – | – | – | – | MISP Galaxy |
| TA402TA402 is an APT group that has been tracked by Proofpoint since 2020. They primarily target government entities in the Middle East and North Africa, with a focus on intelligence collection. TA402 is known for using sophi | Palestine | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.