WIRTE

Summary

Middle Eastern cyberespionage actor active since at least August 2018, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang (MITRE G0090) and tracked by Unit 42 as Ashen Lepus. It targets diplomatic, financial, military, legal and technology organisations across the Middle East, North Africa and Europe, chiefly Arabic-speaking government bodies, using spearphishing with geopolitical lures, DLL side-loading and loaders that hide payloads inside HTML tags on C2 pages. Check Point tracked a campaign from late 2023 using the IronWind loader and later Havoc against the Palestinian Authority, Jordan, Egypt and Saudi Arabia (targeting described as likely), and linked the group's custom malware to the SameCoin wiper used against Israeli entities in February and October 2024, including emails sent from a legitimate Israeli ESET reseller's address. In December 2025 Unit 42 described a new AshTag .NET malware suite, hands-on theft of diplomatic documents with Rclone, activity continuing after the October 2025 Gaza ceasefire, and expansion to entities in Oman and Morocco.

Attribution

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Believed a subgroup of the Hamas-affiliated Gaza Cybergang
• Palo Alto Networks Unit 42 (Research, 2025-12-11)
  Tracks it as Hamas-affiliate Ashen Lepus
• Check Point Research (Research, 2024-11-12)
  A Hamas-affiliated threat actor

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 12

Malware and tools 8

Infrastructure patterns

• C2 answers only sample-specific user agents and checks location; redirects to news sites (Check Point, 2024; MITRE ATT&CK, 2026)
• HTTPS C2 on ports 2083 and 2087; lookalike domains imitating security vendors (MITRE ATT&CK, 2026)

Reporting and advisories 3

• Unit 42
  Hamas-Affiliate Ashen Lepus Uses New Malware Suite AshTag
• Check Point Research
  Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity
• MITRE ATT&CK
  WIRTE (G0090) group profile