G0090 · 11 ATT&CK techniques · 8 correlated reports

WIRTE

Aliases: None listed

WIRTE is a threat group that has been active since at least August 2018. WIRTE has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe.

Open interactive actor investigation

ATT&CK techniques

T1059.001
PowerShellT1571
Non-Standard PortT1059.005
Visual BasicT1204.002
Malicious FileT1140
Deobfuscate/Decode Files or InformationT1566.001
Spearphishing AttachmentT1036.005
Match Legitimate Name or LocationT1588.002
ToolT1071.001
Web ProtocolsT1218.010
Regsvr32T1105
Ingress Tool Transfer

Correlated CTI and IR reports

Actor Deep Research Prompts
Israel Threat Actors CTI · explicit report mentionCyber Threat Intelligence Dossier: Iranian and Hamas-Aligned Operations Targeting Israeli and Allied Ecosystems (2023-2026)
Israel Threat Actors CTI · explicit report mentionDefensive CTI Research on Threats to Israeli Government and Public-Sector Environments
Israel Threat Actors CTI · explicit report mentionIsrael Government Threat Actors CTI: Evidentiary Foundation Intake
Israel Threat Actors CTI · explicit report mentionIsrael-Hamas War Cyber Domain Activity of Interest
SentinelOne · downloaded report actor contextTA402 uses complex IronWind infection chains
Proofpoint · downloaded report actor contextHamas affiliate Ashen Lepus uses new malware suite AshTag
Unit 42 · actor contextHamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
Check Point Research · actor context

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research